ecfc4a6ffb3b5185f90c2db808680e343bd932eeeac5d4f91d7df6bbdf08ecad

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-02_98d3ac90bf564b00b6207c857c6725a9_cryptolocker.exe
Size

39KB
MD5

98d3ac90bf564b00b6207c857c6725a9
SHA1

f076509012b3b3aec8bfa79abd5f5cdc2f0eddb2
SHA256

ecfc4a6ffb3b5185f90c2db808680e343bd932eeeac5d4f91d7df6bbdf08ecad
SHA512

2cda726fc5a8a1a0e5efc613e9b0509adf85de5b540f45e0eca749c21c074d88340046774b0fecaf81526eed2a71684f708bacdb8398f002c5a63d140f209523
SSDEEP

768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvhx5/xFR8L:m5nkFNMOtEvwDpjG8hhXO

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/1988-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000b00000001224c-11.dat	CryptoLocker_rule2
behavioral1/memory/1988-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2784-16-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2784-26-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 3 IoCs

resource	yara_rule
behavioral1/memory/1988-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2784-16-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2784-26-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral1/memory/1988-0-0x0000000000500000-0x000000000050E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x000b00000001224c-11.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1988-15-0x0000000000500000-0x000000000050E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2784-16-0x0000000000500000-0x000000000050E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2784-26-0x0000000000500000-0x000000000050E000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

pid	Process
2784	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1988	2024-02-02_98d3ac90bf564b00b6207c857c6725a9_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2784	1988	2024-02-02_98d3ac90bf564b00b6207c857c6725a9_cryptolocker.exe	28
PID 1988 wrote to memory of 2784	1988	2024-02-02_98d3ac90bf564b00b6207c857c6725a9_cryptolocker.exe	28
PID 1988 wrote to memory of 2784	1988	2024-02-02_98d3ac90bf564b00b6207c857c6725a9_cryptolocker.exe	28
PID 1988 wrote to memory of 2784	1988	2024-02-02_98d3ac90bf564b00b6207c857c6725a9_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-02_98d3ac90bf564b00b6207c857c6725a9_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-02_98d3ac90bf564b00b6207c857c6725a9_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
39KB

MD5
be349f8bcec600aff3b6184fc7c25de4

SHA1
1861654c0617cd91f0bc9d794340cc43c312ea91

SHA256
cfbcc793c41538ced27238c4a8d27628b4afea3ee47c8799bd47f9d8938f99ef

SHA512
ee8a83d664ba0a6c9c70876ed7ecb8cf1402d5021bd1806ab09be46316d04906701499f8f629a3b11dee5f1f88f743fe1ff18363de26b4508a8b75ced7750af5

Download Submit
memory/1988-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/1988-1-0x00000000003A0000-0x00000000003A6000-memory.dmp

Filesize
24KB

Download
memory/1988-2-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/1988-9-0x00000000003A0000-0x00000000003A6000-memory.dmp

Filesize
24KB

Download
memory/1988-15-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2784-16-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2784-18-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/2784-20-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2784-26-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download