4cf2f03e4765f3e846b3f4562a3657e33b71e82dbfc0f8fffe2221e3729c6c29

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-17_3df361889fbc22da3792be23d62d7726_cryptolocker.exe
Size

78KB
MD5

3df361889fbc22da3792be23d62d7726
SHA1

2cdf7431432de2bdec2d5b967a4ece6acf75b2af
SHA256

4cf2f03e4765f3e846b3f4562a3657e33b71e82dbfc0f8fffe2221e3729c6c29
SHA512

27fa64be2cdfdb1b4177caa24e7f86394cd89933da918fb4c1e78bdbb9aac1e8e3ec1b8ea134e4630e2543d0ec67bc3aa03719246211c1dec487dcb2a76e7e44
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ3KUp:ZVxkGOtEvwDpjca9

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000141c0-11.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2416	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2380	2024-06-17_3df361889fbc22da3792be23d62d7726_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2416	2380	2024-06-17_3df361889fbc22da3792be23d62d7726_cryptolocker.exe	28
PID 2380 wrote to memory of 2416	2380	2024-06-17_3df361889fbc22da3792be23d62d7726_cryptolocker.exe	28
PID 2380 wrote to memory of 2416	2380	2024-06-17_3df361889fbc22da3792be23d62d7726_cryptolocker.exe	28
PID 2380 wrote to memory of 2416	2380	2024-06-17_3df361889fbc22da3792be23d62d7726_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-17_3df361889fbc22da3792be23d62d7726_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-17_3df361889fbc22da3792be23d62d7726_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
78KB

MD5
e2ac4e3bdabb6fe87b398f67de680cb8

SHA1
121d8a8a6c67b9bc345c5a2da9c422d96a51b655

SHA256
31a76ed7c00eaf26bf5eaee41e7a3fde98ee9be1e5b4804f6a18d246623f74a8

SHA512
4ddf0c27843de3a4dea99ffa531e0ca0495824058e5e59811f44ba2876ee7598824a5168bc177645877a187e78e4daf0a0fc0b21ccfcb5634342c4f58af436d3

Download Submit
memory/2380-0-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download
memory/2380-1-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2380-2-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/2380-9-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2416-24-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2416-23-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2416-16-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2416-25-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download