1e279ab7ad6d6b9c760399dc41dacbc849934cca615c23b92bf0ef180251382d

Analysis

max time kernel
150s
max time network
161s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-09_a8bd32eb638321e2f9df23f350f8fc05_cryptolocker.exe
Size

47KB
MD5

a8bd32eb638321e2f9df23f350f8fc05
SHA1

679141d317d917b2338c4d2f01508a7aacadb681
SHA256

1e279ab7ad6d6b9c760399dc41dacbc849934cca615c23b92bf0ef180251382d
SHA512

37cbac7e9ddacec4b95fc0bc5eccc01a22cea0e669032f00700a138c9314d2d381ef65be2deda65362059f32c097f58d04cea10cc2ec415edea9a0a188dd9892
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9RzhwaRh+EP:xj+VGMOtEvwDpjy+TRh+EP

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2060-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000d00000001226b-11.dat	CryptoLocker_rule2
behavioral1/memory/1724-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2060-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1724-27-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/2060-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000d00000001226b-11.dat	CryptoLocker_set1
behavioral1/memory/1724-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2060-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1724-27-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral1/memory/2060-0-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x000d00000001226b-11.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1724-17-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2060-16-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1724-27-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

pid	Process
1724	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2060	2024-05-09_a8bd32eb638321e2f9df23f350f8fc05_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 1724	2060	2024-05-09_a8bd32eb638321e2f9df23f350f8fc05_cryptolocker.exe	28
PID 2060 wrote to memory of 1724	2060	2024-05-09_a8bd32eb638321e2f9df23f350f8fc05_cryptolocker.exe	28
PID 2060 wrote to memory of 1724	2060	2024-05-09_a8bd32eb638321e2f9df23f350f8fc05_cryptolocker.exe	28
PID 2060 wrote to memory of 1724	2060	2024-05-09_a8bd32eb638321e2f9df23f350f8fc05_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-09_a8bd32eb638321e2f9df23f350f8fc05_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-09_a8bd32eb638321e2f9df23f350f8fc05_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
47KB

MD5
98d33bdfb8359aa0da0fcd88c0143f08

SHA1
5455a9a6fc28b34c72f2535d4954e091c34b039b

SHA256
01c528caf214d426e79c6a0ab577725c0e0743e220e70e73a5dd1691236c0dc3

SHA512
28963fe2d171ce2b2fa2fe7507a5e834ed3961dcd3d8c0b5f71bae750f8ae54e58d5446858fcb48f6f6ff63219adaf5754a6cf6ae5a115c6f96ff5d985131b43

Download Submit
memory/1724-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1724-26-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1724-19-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/1724-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2060-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2060-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2060-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2060-3-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2060-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2060-14-0x0000000001D30000-0x0000000001D40000-memory.dmp

Filesize
64KB

Download