c791c9d0151fe9c2a8047afdd4bcdb7f3847f60f2b3446a2f782a3c37ea29266

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-04-2024 06:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-03_15d330369dcbb317ef7b9404d5822ef3_cryptolocker.exe
Size

63KB
MD5

15d330369dcbb317ef7b9404d5822ef3
SHA1

b7dcc5dcf0b4d25561c914f6445f2c55fcea9a9a
SHA256

c791c9d0151fe9c2a8047afdd4bcdb7f3847f60f2b3446a2f782a3c37ea29266
SHA512

6fb798fdd8b7a2cb9f9a8c0ec34b194dd9828c88b4eb432a660fc5f8c4c8ee3fe25e696231241a8661dbf255631fce1e42919afede7e728a6c373a9eb1892d49
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEISuN:6j+1NMOtEvwDpjr8ox8UDE3y

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2624-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2
behavioral1/memory/2624-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2660-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2660-26-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2624-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1
behavioral1/memory/2624-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2660-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2660-26-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2624-0-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
\Users\Admin\AppData\Local\Temp\misid.exe	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2624-15-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2660-17-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2660-26-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2660 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-04-03_15d330369dcbb317ef7b9404d5822ef3_cryptolocker.exe

pid process

2624 2024-04-03_15d330369dcbb317ef7b9404d5822ef3_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2660	misid.exe

pid	process
2624	2024-04-03_15d330369dcbb317ef7b9404d5822ef3_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-04-03_15d330369dcbb317ef7b9404d5822ef3_cryptolocker.exe

description	pid	process	target process
PID 2624 wrote to memory of 2660	2624	2024-04-03_15d330369dcbb317ef7b9404d5822ef3_cryptolocker.exe	misid.exe
PID 2624 wrote to memory of 2660	2624	2024-04-03_15d330369dcbb317ef7b9404d5822ef3_cryptolocker.exe	misid.exe
PID 2624 wrote to memory of 2660	2624	2024-04-03_15d330369dcbb317ef7b9404d5822ef3_cryptolocker.exe	misid.exe
PID 2624 wrote to memory of 2660	2624	2024-04-03_15d330369dcbb317ef7b9404d5822ef3_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-03_15d330369dcbb317ef7b9404d5822ef3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-03_15d330369dcbb317ef7b9404d5822ef3_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2660

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
63KB

MD5
59989acb47b25acadc2f0ab61f70c750

SHA1
9317130da34803da1da3a72b4364d19473775fe8

SHA256
aa6cd1c63ad52961be8c67dab9c75ea797a9d19b2f23435e7aa63eb7a15d1100

SHA512
deae0f866715f1c7c9c39ff4d0ce88e276c7bf8416140c023babd0f5fd5bfea9afe02e07d5d040a92a1012b7e83c242b056c33490fc1aa6ab1abdcd915f4bfdc

Download Submit
memory/2624-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2624-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2624-3-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2624-2-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2624-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2660-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2660-18-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2660-21-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2660-26-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download