0b75ab57a9dc0e397ff2cce783cb8628ff68a9a241978598d4a85098b3bda5e2

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-13_73563319660481bd66bca2cd855ce9d1_cryptolocker.exe
Size

87KB
MD5

73563319660481bd66bca2cd855ce9d1
SHA1

ccc6978dcab79b2072b94d8d09b5e723e8cf1a80
SHA256

0b75ab57a9dc0e397ff2cce783cb8628ff68a9a241978598d4a85098b3bda5e2
SHA512

a8eddc33f957bcec37a438feddac51028601b7f5f321796809e7eb1460ca61de292d32c3904346ba510762d6f5baf9a3c4a3cad7151fa9e75b58de3dd4c6001c
SSDEEP

768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRXrZSUfFKazNclMjNUvxgn3:i5nkFGMOtEvwDpjNbwQEI8UtzNcO8y3

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 6 IoCs

resource	yara_rule
behavioral1/memory/3020-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000700000001225f-11.dat	CryptoLocker_rule2
behavioral1/memory/3020-12-0x00000000004E0000-0x00000000004EF000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/3000-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/3020-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/3000-27-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/3020-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/3000-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/3020-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/3000-27-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 6 IoCs

resource	yara_rule
behavioral1/memory/3020-0-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x000700000001225f-11.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/3020-12-0x00000000004E0000-0x00000000004EF000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/3000-17-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/3020-15-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/3000-27-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

pid	Process
3000	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
3020	2024-03-13_73563319660481bd66bca2cd855ce9d1_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 3000	3020	2024-03-13_73563319660481bd66bca2cd855ce9d1_cryptolocker.exe	28
PID 3020 wrote to memory of 3000	3020	2024-03-13_73563319660481bd66bca2cd855ce9d1_cryptolocker.exe	28
PID 3020 wrote to memory of 3000	3020	2024-03-13_73563319660481bd66bca2cd855ce9d1_cryptolocker.exe	28
PID 3020 wrote to memory of 3000	3020	2024-03-13_73563319660481bd66bca2cd855ce9d1_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-13_73563319660481bd66bca2cd855ce9d1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-13_73563319660481bd66bca2cd855ce9d1_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
87KB

MD5
f80079a811c7735e8a02afad74bfb95d

SHA1
3da1afa90d08a48a58a1b68b37f8416a7d91c190

SHA256
e73492efc471787e19f16db8d2e31251564278293820685396faed49b57f14a5

SHA512
fcc3f7c7eefbd989745dac15b5b019ea60cf38c5ef7ef920f508cb4568e0507c274887895138696fbf24f03ee81f17be3be08d521b0884d311f79266da3133e3

Download Submit
memory/3000-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3000-19-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/3000-22-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3000-27-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3020-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3020-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3020-3-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3020-2-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/3020-12-0x00000000004E0000-0x00000000004EF000-memory.dmp

Filesize
60KB

Download
memory/3020-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download