db0b69b204aedf4e54513056ac1f1786785c1f306e94da5f9900e65f51658d7a

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 05:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-13_9a72f6e605ddcf3d99cf6bd6ef8bf765_cryptolocker.exe
Size

93KB
MD5

9a72f6e605ddcf3d99cf6bd6ef8bf765
SHA1

ffe4dc1f6e0717e8f3e230af8a108a440b6e4052
SHA256

db0b69b204aedf4e54513056ac1f1786785c1f306e94da5f9900e65f51658d7a
SHA512

f00baf77686176293bd074672bb118cf5c6d475eb5f3d6ec9810d7cfec3794d25b3646be9d1f1950fb8ee097e70eec722b60d98bbd73da394d6524c5941d2ab5
SSDEEP

1536:zj+soPSMOtEvwDpj4ktBl01hJl8QAPM8Ho6cRDjgx/Tg:zCsanOtEvwDpjB8

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/456-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x0009000000012252-11.dat	CryptoLocker_rule2
behavioral1/memory/456-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2740-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2740-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/456-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x0009000000012252-11.dat	CryptoLocker_set1
behavioral1/memory/456-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2740-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2740-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral1/memory/456-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/files/0x0009000000012252-11.dat	UPX
behavioral1/memory/456-15-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2740-16-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2740-26-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2740	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
456	2024-02-13_9a72f6e605ddcf3d99cf6bd6ef8bf765_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/456-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x0009000000012252-11.dat	upx
behavioral1/memory/456-15-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2740-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2740-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 2740	456	2024-02-13_9a72f6e605ddcf3d99cf6bd6ef8bf765_cryptolocker.exe	28
PID 456 wrote to memory of 2740	456	2024-02-13_9a72f6e605ddcf3d99cf6bd6ef8bf765_cryptolocker.exe	28
PID 456 wrote to memory of 2740	456	2024-02-13_9a72f6e605ddcf3d99cf6bd6ef8bf765_cryptolocker.exe	28
PID 456 wrote to memory of 2740	456	2024-02-13_9a72f6e605ddcf3d99cf6bd6ef8bf765_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-13_9a72f6e605ddcf3d99cf6bd6ef8bf765_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-13_9a72f6e605ddcf3d99cf6bd6ef8bf765_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:456
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
93KB

MD5
1a85c48444cf465d3c93303700e860cb

SHA1
33a61428c975f29d8cca1fe6f0cc7aeb1b38b1b4

SHA256
86c309b5823825804e3602897a79e0231274fb975ba3f6cefbc6af9e7db72e94

SHA512
f7f45b823f5ba529798ddb8f46c6ad0e79f9011d99bd137bd5da0bccc641d3422ae33a68b6044422957463ae5f91fa6671b9d482588358084e6cdb8725cdd76e

Download Submit
memory/456-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/456-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/456-2-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/456-4-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/456-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2740-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2740-18-0x0000000000510000-0x0000000000516000-memory.dmp

Filesize
24KB

Download
memory/2740-20-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2740-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download