3b134bdf7f4042cd920b906f85b14a26a8aad1902349a784858e5d3de3723da6

Analysis

max time kernel
147s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 21:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024052424791237e441ce0d7038c13bd034af59cryptolocker.exe
Size

37KB
MD5

24791237e441ce0d7038c13bd034af59
SHA1

e316e510d3dd40bbd2f830e3fd991a6f3a82498e
SHA256

3b134bdf7f4042cd920b906f85b14a26a8aad1902349a784858e5d3de3723da6
SHA512

88a879cd564a8d4473832b97064b4882bf28e589cc61fd153a05a22e8f14e1f0d0e8b7dc092a96dadd759d7f320ad4361ceb5e91d6667e4cf3300c0eee3f4d8f
SSDEEP

768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4El:fT+hsMQMOtEvwDpjoIHa

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2144	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1524	2024052424791237e441ce0d7038c13bd034af59cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 2144	1524	2024052424791237e441ce0d7038c13bd034af59cryptolocker.exe	28
PID 1524 wrote to memory of 2144	1524	2024052424791237e441ce0d7038c13bd034af59cryptolocker.exe	28
PID 1524 wrote to memory of 2144	1524	2024052424791237e441ce0d7038c13bd034af59cryptolocker.exe	28
PID 1524 wrote to memory of 2144	1524	2024052424791237e441ce0d7038c13bd034af59cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024052424791237e441ce0d7038c13bd034af59cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024052424791237e441ce0d7038c13bd034af59cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
37KB

MD5
5b70508c7af004e32491115b4465d598

SHA1
ba841f5e465554ceee6e09dc184397a6caf16339

SHA256
744c9ddb1133e63645948d11e664746777e0aaee49991336da7ee50d38198708

SHA512
52eba0f0e067b993b801494acfb507b9d09a23097a9024d5cd93be6582746bc5508e2f695b302db1a0a2d6838cd59a0729b5ca9ee124091667d01247f97708f3

Download Submit
memory/1524-0-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/1524-1-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/1524-8-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2144-15-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2144-22-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download