6b52f7dfef6290bdcdd50fd986b6726928832b633f0874c4d0438823e60acc82

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-22_e416a86d0f5944e5347d285525d6a920_cryptolocker.exe
Size

54KB
MD5

e416a86d0f5944e5347d285525d6a920
SHA1

93ec7071abebb704385792db9be88f6d188e3da9
SHA256

6b52f7dfef6290bdcdd50fd986b6726928832b633f0874c4d0438823e60acc82
SHA512

de6a52afd2f940d0e5498fd677f5c5e130f28bdd7dec62bd6c7dde36b687dc0b8aa04af7669f733b5dc8f939e98a63ccbcb41d46e063ac67dcf66df2c98fd72c
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbP/MMj:xj+VGMOtEvwDpjubXMMj

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2992-1-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x0009000000012251-11.dat	CryptoLocker_rule2
behavioral1/memory/2992-13-0x00000000006F0000-0x0000000000700000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2992-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2548-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/2992-1-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x0009000000012251-11.dat	CryptoLocker_set1
behavioral1/memory/2992-13-0x00000000006F0000-0x0000000000700000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2992-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2548-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral1/memory/2992-1-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x0009000000012251-11.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2992-13-0x00000000006F0000-0x0000000000700000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2992-15-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2548-26-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

pid	Process
2548	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2992	2024-02-22_e416a86d0f5944e5347d285525d6a920_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2548	2992	2024-02-22_e416a86d0f5944e5347d285525d6a920_cryptolocker.exe	28
PID 2992 wrote to memory of 2548	2992	2024-02-22_e416a86d0f5944e5347d285525d6a920_cryptolocker.exe	28
PID 2992 wrote to memory of 2548	2992	2024-02-22_e416a86d0f5944e5347d285525d6a920_cryptolocker.exe	28
PID 2992 wrote to memory of 2548	2992	2024-02-22_e416a86d0f5944e5347d285525d6a920_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-22_e416a86d0f5944e5347d285525d6a920_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-22_e416a86d0f5944e5347d285525d6a920_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
54KB

MD5
01f5b58efc5254d4c35bcd60db948c6d

SHA1
b01197e67373c04981a6b0d5a99ad39f909e607e

SHA256
f0a81deca62ea9412f21a69de28329eb5c990f46f6a69c527718b94118ee22ed

SHA512
41872490eea32231d804c4f680b35b6c6539ecbe0c172a2cb6c3170e9ce1682df59cdad87896390abebccfcf24ccf5b751719c008b741e698c9d81ea28d75c2c

Download Submit
memory/2548-18-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2548-23-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2548-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2992-1-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2992-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2992-3-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2992-2-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2992-13-0x00000000006F0000-0x0000000000700000-memory.dmp

Filesize
64KB

Download
memory/2992-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download