3159ab54c120073d5a79fac1e073a3ed6a04198663908f30e2268d7c77999421

Analysis

max time kernel
143s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27-01-2024 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-27_43ffa5280b9bf0b667dfa93dcb035474_cryptolocker.exe
Size

61KB
MD5

43ffa5280b9bf0b667dfa93dcb035474
SHA1

efd008eb9d584d9542fb72a878c426d49b3815d8
SHA256

3159ab54c120073d5a79fac1e073a3ed6a04198663908f30e2268d7c77999421
SHA512

5f2fbfe5aba8a6687a2be4fbcbc37bf4e82d57e958d862fd5036c4b2b9e760d253863d8c2c4efae7bdaa994d54cebd1826da2eb48d1d8a161973f8df665e6c76
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEiN/:6j+1NMOtEvwDpjr8ox8UDEiN

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/2932-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x0009000000012203-14.dat	CryptoLocker_rule2
behavioral1/memory/1140-25-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2932-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/2932-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x0009000000012203-14.dat	CryptoLocker_set1
behavioral1/memory/1140-25-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2932-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 4 IoCs

resource	yara_rule
behavioral1/memory/2932-15-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x0009000000012203-14.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1140-25-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2932-0-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

pid	Process
1140	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2932	2024-01-27_43ffa5280b9bf0b667dfa93dcb035474_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 1140	2932	2024-01-27_43ffa5280b9bf0b667dfa93dcb035474_cryptolocker.exe	16
PID 2932 wrote to memory of 1140	2932	2024-01-27_43ffa5280b9bf0b667dfa93dcb035474_cryptolocker.exe	16
PID 2932 wrote to memory of 1140	2932	2024-01-27_43ffa5280b9bf0b667dfa93dcb035474_cryptolocker.exe	16
PID 2932 wrote to memory of 1140	2932	2024-01-27_43ffa5280b9bf0b667dfa93dcb035474_cryptolocker.exe	16

C:\Users\Admin\AppData\Local\Temp\2024-01-27_43ffa5280b9bf0b667dfa93dcb035474_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-27_43ffa5280b9bf0b667dfa93dcb035474_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
61KB

MD5
126f6be1050b06b06c64ee9098c360f1

SHA1
0fab2d3b563bbcf8e83c39c56a93625abc203c27

SHA256
0740b433037ab363b567a9506130ff58d316599a6c3ede527cdd424b981a1559

SHA512
c8fdcc754f8c5ca77ed8eb95a3aa3756e08679d2344870518d7dd00640c4bec7749273b0135075892ea96a0aef474cdf4f2ff8ce7854853f98e005610bbd79b4

Download Submit
memory/1140-17-0x00000000004C0000-0x00000000004C6000-memory.dmp

Filesize
24KB

Download
memory/1140-24-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/1140-25-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2932-2-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2932-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2932-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2932-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2932-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download