ded57860447d25b0cded48b81fa16b535252c5fc09df9c7b61292eababa8283c

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 04:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_daeebe6e86cfeef0117437e165b4c421_cryptolocker.exe
Size

55KB
MD5

daeebe6e86cfeef0117437e165b4c421
SHA1

56f3aead951b75b6325c6b1d8ad329bdba714e8e
SHA256

ded57860447d25b0cded48b81fa16b535252c5fc09df9c7b61292eababa8283c
SHA512

beeb28208848060182dfb11006ceacf7e8e6c1bee23346be3d036cffe5bc5f6e41ac6c406c6a5ec94c5fae2a7962ae9edad7e0a17337487fc5e3e9961e298c1c
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdO5Uj8:ZVxkGOtEvwDpjcF

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001227b-11.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2884	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2020	2024-05-23_daeebe6e86cfeef0117437e165b4c421_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2884	2020	2024-05-23_daeebe6e86cfeef0117437e165b4c421_cryptolocker.exe	28
PID 2020 wrote to memory of 2884	2020	2024-05-23_daeebe6e86cfeef0117437e165b4c421_cryptolocker.exe	28
PID 2020 wrote to memory of 2884	2020	2024-05-23_daeebe6e86cfeef0117437e165b4c421_cryptolocker.exe	28
PID 2020 wrote to memory of 2884	2020	2024-05-23_daeebe6e86cfeef0117437e165b4c421_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-23_daeebe6e86cfeef0117437e165b4c421_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_daeebe6e86cfeef0117437e165b4c421_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
55KB

MD5
32c14d68779fbbe423742a4cb11244e7

SHA1
82577e5df09cbcbc83a9701172c68861d644d78f

SHA256
00c672f279cd6ce6f110df9b76294e72fb9a5db15e486ed0fda1d4223db034f4

SHA512
3d4e0724bb880442455d4888047b9117a7f7d23022b42471e3625413b2736dd55899d32a5ced6e3a4463cf2494ee0ef00395fc9406d64662ae76933c176c6306

Download Submit
memory/2020-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2020-1-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2020-2-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2020-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2884-16-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2884-24-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2884-23-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2884-25-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download