0bf26470ed4ab5670c5fae9b4d99112851ce77820950dc95a136de26d16045c5

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 15:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-21_44f5eaaa850849bfe687c64ad922eb9b_cryptolocker.exe
Size

55KB
MD5

44f5eaaa850849bfe687c64ad922eb9b
SHA1

42d5898971909d50973b1b66d1d8bf21bcb7deb2
SHA256

0bf26470ed4ab5670c5fae9b4d99112851ce77820950dc95a136de26d16045c5
SHA512

892804fa11364042395b46b7d5d06dad3fd8df73b915c9ff1cbb5a429b563c5e2e58f4887420047a95393999a9e6379e6d8bfefb13343d9b69166106b9e4ae3e
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbP/0GgF0:xj+VGMOtEvwDpjubXdgq

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/2220-8-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000b0000000122b8-11.dat	CryptoLocker_rule2
behavioral1/memory/2380-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2380-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/2220-8-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000b0000000122b8-11.dat	CryptoLocker_set1
behavioral1/memory/2380-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2380-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 4 IoCs

resource	yara_rule
behavioral1/memory/2220-8-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x000b0000000122b8-11.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2380-16-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2380-25-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

pid	Process
2380	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2220	2024-02-21_44f5eaaa850849bfe687c64ad922eb9b_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2380	2220	2024-02-21_44f5eaaa850849bfe687c64ad922eb9b_cryptolocker.exe	28
PID 2220 wrote to memory of 2380	2220	2024-02-21_44f5eaaa850849bfe687c64ad922eb9b_cryptolocker.exe	28
PID 2220 wrote to memory of 2380	2220	2024-02-21_44f5eaaa850849bfe687c64ad922eb9b_cryptolocker.exe	28
PID 2220 wrote to memory of 2380	2220	2024-02-21_44f5eaaa850849bfe687c64ad922eb9b_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-21_44f5eaaa850849bfe687c64ad922eb9b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-21_44f5eaaa850849bfe687c64ad922eb9b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
55KB

MD5
11521b297bf57eb04cf1d555f61bd21b

SHA1
db45b0797d0c8e36a2f06abc455fe1e676038f5b

SHA256
01d5c00432ec152f515c22fa36e99820670ed4625382d50e11993fa641a01cd2

SHA512
dd0ffcfa735c389c678b7174d102cf98d69694354ddad6be475ff5b6590f5e51d2a1232a5686107d95613586cdaf32199382ef71680d7ce2fd6066d6a6ce19a3

Download Submit
memory/2220-1-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2220-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2220-8-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2220-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2220-15-0x0000000000490000-0x00000000004A0000-memory.dmp

Filesize
64KB

Download
memory/2380-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2380-18-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2380-25-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download