09f59de40dc3476fdc3cc361183dc107b7f147c350f5f6a582245f6815f9e18d

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 04:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-30_efd3c6f596e4e6282a1c8cedfec32f92_cryptolocker.exe
Size

76KB
MD5

efd3c6f596e4e6282a1c8cedfec32f92
SHA1

d659d01b1a9cdf4391d7ae1e56127c92dc5f2189
SHA256

09f59de40dc3476fdc3cc361183dc107b7f147c350f5f6a582245f6815f9e18d
SHA512

ca2da31b8ff2e979a793266a5300a7af9c112ab83573f4245b3a7513ea432ce5275930b7dbfd9e533c74c63d463cb6bf49434320cdcff997c56c535673877062
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ3KUn:ZVxkGOtEvwDpjcaD

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001226d-11.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2608	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2368	2024-05-30_efd3c6f596e4e6282a1c8cedfec32f92_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2608	2368	2024-05-30_efd3c6f596e4e6282a1c8cedfec32f92_cryptolocker.exe	28
PID 2368 wrote to memory of 2608	2368	2024-05-30_efd3c6f596e4e6282a1c8cedfec32f92_cryptolocker.exe	28
PID 2368 wrote to memory of 2608	2368	2024-05-30_efd3c6f596e4e6282a1c8cedfec32f92_cryptolocker.exe	28
PID 2368 wrote to memory of 2608	2368	2024-05-30_efd3c6f596e4e6282a1c8cedfec32f92_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-30_efd3c6f596e4e6282a1c8cedfec32f92_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-30_efd3c6f596e4e6282a1c8cedfec32f92_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
76KB

MD5
82fba8ae35489a057eb5ebfd64f64d5c

SHA1
6070a29c03e2ffce7f236c562a517a76778efd77

SHA256
a0b03d7e9c6ce36cf5561dd5439fec3d0c20965aa774ed595c60f5ff0dca3379

SHA512
bf867aa7fdb899d1d7bd38f9fe76ca76415d07eedd36b340cf9851e9125d417c71c0d43af2f2ef23cc53323cd20a51bff90401cb6f92712d178e82a54a8a9240

Download Submit
memory/2368-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2368-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2368-8-0x0000000000230000-0x00000000002B0000-memory.dmp

Filesize
512KB

Download
memory/2368-1-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2608-24-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2608-23-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2608-25-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download