0e6d0c8c07e53aa456b044fe6392d9363511a3229a59eaa7c936b77b238a7d4b

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 21:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-28_8306a7f1573cfc76c4c259e9e9b8a3fd_cryptolocker.exe
Size

47KB
MD5

8306a7f1573cfc76c4c259e9e9b8a3fd
SHA1

0f9175485f0a92f4bee99ee0e3b2bf300be4799e
SHA256

0e6d0c8c07e53aa456b044fe6392d9363511a3229a59eaa7c936b77b238a7d4b
SHA512

70d8ae4ee16161ac444bbb9a5425068d24c4d0de10ed1712a5893c39df1a0aa9f31f29e6dc15262eb652814bf85ace035d1f9177cc1cd676f557b7599c1b2f44
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9Rva/yYsmm:xj+VGMOtEvwDpjy+viHsn

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/824-1-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000b0000000149f5-11.dat	CryptoLocker_rule2
behavioral1/memory/824-13-0x0000000000670000-0x0000000000680000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2164-19-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/824-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/824-1-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000b0000000149f5-11.dat	CryptoLocker_set1
behavioral1/memory/824-13-0x0000000000670000-0x0000000000680000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2164-19-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/824-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral1/memory/824-1-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x000b0000000149f5-11.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/824-13-0x0000000000670000-0x0000000000680000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2164-19-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/824-16-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

pid	Process
2164	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
824	2024-04-28_8306a7f1573cfc76c4c259e9e9b8a3fd_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 2164	824	2024-04-28_8306a7f1573cfc76c4c259e9e9b8a3fd_cryptolocker.exe	28
PID 824 wrote to memory of 2164	824	2024-04-28_8306a7f1573cfc76c4c259e9e9b8a3fd_cryptolocker.exe	28
PID 824 wrote to memory of 2164	824	2024-04-28_8306a7f1573cfc76c4c259e9e9b8a3fd_cryptolocker.exe	28
PID 824 wrote to memory of 2164	824	2024-04-28_8306a7f1573cfc76c4c259e9e9b8a3fd_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-28_8306a7f1573cfc76c4c259e9e9b8a3fd_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-28_8306a7f1573cfc76c4c259e9e9b8a3fd_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:824
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
47KB

MD5
e47a435f259cb91900a5e540f8a809ab

SHA1
6000b15fab5cbf0d05905d6db9f61651338b53bc

SHA256
daf17e2f578bd1923734ca632efaabf817ce5251dfda3c0afbba7480f22a961e

SHA512
ea12eedce6a91040078bd4862c7dd9240e1ac551757211dfb7336d96ccfaf0a1926cf35e4ccd815b0737afd766178c68b472de180af2abf8ec45484a68043a55

Download Submit
memory/824-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/824-1-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/824-2-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/824-9-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/824-13-0x0000000000670000-0x0000000000680000-memory.dmp

Filesize
64KB

Download
memory/824-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2164-20-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2164-19-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2164-18-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download