ebf6137786496a4d772adae6160615ea6ff9e3691d28483d3c555b14302ed231

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 04:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-25_d870c97ba68143ef4bafe70f34ec011a_cryptolocker.exe
Size

50KB
MD5

d870c97ba68143ef4bafe70f34ec011a
SHA1

c745e38c58a563e0c001ef852bac79688212b0a8
SHA256

ebf6137786496a4d772adae6160615ea6ff9e3691d28483d3c555b14302ed231
SHA512

2daf458dc5b6118859fdc753c33907b8e94c2cdcc5431181b0514251333eb2a43cd004382fa080aa1b46f0736664d8fdbd8d38d44858277ac1199de7f066a86d
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprqQ15x8rU:ZVxkGOtEvwDpjcE

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000015cff-11.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
1728	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2972	2024-05-25_d870c97ba68143ef4bafe70f34ec011a_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 1728	2972	2024-05-25_d870c97ba68143ef4bafe70f34ec011a_cryptolocker.exe	28
PID 2972 wrote to memory of 1728	2972	2024-05-25_d870c97ba68143ef4bafe70f34ec011a_cryptolocker.exe	28
PID 2972 wrote to memory of 1728	2972	2024-05-25_d870c97ba68143ef4bafe70f34ec011a_cryptolocker.exe	28
PID 2972 wrote to memory of 1728	2972	2024-05-25_d870c97ba68143ef4bafe70f34ec011a_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-25_d870c97ba68143ef4bafe70f34ec011a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-25_d870c97ba68143ef4bafe70f34ec011a_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
50KB

MD5
56051301300d9620a1bc80d502680f33

SHA1
7264793b0f9d8f3ff7d3aba79aa888eb6713f2a2

SHA256
e69a0b05028372d6c541422b742318bcd5f4c1bf2a2f8b071b5b268893372bb8

SHA512
d6bdd2def336cc7c81acdccbc77f188f031b6139939127ec59983381c0b0eff4d16439c94d9e93db5790246be002bf8111d092e5a0cf589f15dc4289fb3f2dbe

Download Submit
memory/1728-16-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/1728-24-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1728-23-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2972-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2972-1-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2972-8-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2972-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download