8ece53bcdad06233a28fff0f6fba1f18b92a3dbe28430837b54ed530b91b6427

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-28_f532b07a119c2ff696a6024da20f9f20_cryptolocker.exe
Size

42KB
MD5

f532b07a119c2ff696a6024da20f9f20
SHA1

e58b47709c0bce259b887240047586a982c74f26
SHA256

8ece53bcdad06233a28fff0f6fba1f18b92a3dbe28430837b54ed530b91b6427
SHA512

6c3fff32de64513059a24c4c2f900cf56031ea7d1d87b269961cd60fd6999f361ec5ba1168b442a976ac9bbcf0a8c07d6fd233d723f8136b67c11846ff4750e7
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/li:6j+1NMOtEvwDpjrRM

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2220-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c00000001315b-11.dat	CryptoLocker_rule2
behavioral1/memory/2220-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2508-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2508-25-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/2220-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000c00000001315b-11.dat	CryptoLocker_set1
behavioral1/memory/2220-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2508-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2508-25-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral1/memory/2220-0-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x000c00000001315b-11.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2220-15-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2508-17-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2508-25-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

pid	Process
2508	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2220	2024-04-28_f532b07a119c2ff696a6024da20f9f20_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2508	2220	2024-04-28_f532b07a119c2ff696a6024da20f9f20_cryptolocker.exe	28
PID 2220 wrote to memory of 2508	2220	2024-04-28_f532b07a119c2ff696a6024da20f9f20_cryptolocker.exe	28
PID 2220 wrote to memory of 2508	2220	2024-04-28_f532b07a119c2ff696a6024da20f9f20_cryptolocker.exe	28
PID 2220 wrote to memory of 2508	2220	2024-04-28_f532b07a119c2ff696a6024da20f9f20_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-28_f532b07a119c2ff696a6024da20f9f20_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-28_f532b07a119c2ff696a6024da20f9f20_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
42KB

MD5
2dec2dad0eff9b07d2e1cf0b85693e13

SHA1
3d6d56ec6fb8214a4b613fd90de9d1ee65dce03d

SHA256
38685ca39f2190db6b7613f3c66c828dc616c4a1c014c2531a2385bbcc18f47b

SHA512
c26c1da140de4d69dc1297e375ae0ebfd4a31a18ef80202ddf0aa7f8809072c6e40d8889a90be620386141fd99e2bf13149f825c461201ae2be4dda7ff47a430

Download Submit
memory/2220-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2220-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2220-2-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2220-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2220-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2508-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2508-25-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download