4399d76dbb9ae66e19a8c97f6ccf324f66b41356d83c8d3e825fddd1eb9b39ba

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-13_5759e8b897c50e7f32a6cacc313e5ae9_cryptolocker.exe
Size

67KB
MD5

5759e8b897c50e7f32a6cacc313e5ae9
SHA1

b8111c2355a32376cd30c1bda3511a4d4ed1f42a
SHA256

4399d76dbb9ae66e19a8c97f6ccf324f66b41356d83c8d3e825fddd1eb9b39ba
SHA512

d6b8dd69943b25909eaaef2b1caed61fd57cf6c4de4720f9245da7f6ae4dc25112bfcbe11a404d01ed44f31aaec050bf82c0a45e079597b2225577538444ef0b
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEpE0P/xFIh:6j+1NMOtEvwDpjr8ox8UDEpN/jE

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2196-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000b000000015ca5-11.dat	CryptoLocker_rule2
behavioral1/memory/2196-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2384-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2384-26-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/2196-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000b000000015ca5-11.dat	CryptoLocker_set1
behavioral1/memory/2196-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2384-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2384-26-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral1/memory/2196-0-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x000b000000015ca5-11.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2196-15-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2384-16-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2384-26-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

pid	Process
2384	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2196	2024-05-13_5759e8b897c50e7f32a6cacc313e5ae9_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2384	2196	2024-05-13_5759e8b897c50e7f32a6cacc313e5ae9_cryptolocker.exe	28
PID 2196 wrote to memory of 2384	2196	2024-05-13_5759e8b897c50e7f32a6cacc313e5ae9_cryptolocker.exe	28
PID 2196 wrote to memory of 2384	2196	2024-05-13_5759e8b897c50e7f32a6cacc313e5ae9_cryptolocker.exe	28
PID 2196 wrote to memory of 2384	2196	2024-05-13_5759e8b897c50e7f32a6cacc313e5ae9_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-13_5759e8b897c50e7f32a6cacc313e5ae9_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-13_5759e8b897c50e7f32a6cacc313e5ae9_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
67KB

MD5
c2f7e1fec7c49c411fc2c3fdf1593bd3

SHA1
c815501dff7d17de567cf9e642a86cd90e6aa939

SHA256
60947d6b14afbe82240e9d6d660a19f8b49b01c07e6f693e4f2a408b27e45d70

SHA512
c1b45f6067f33b65b633527db99768fa3d775c88956ff3ba15b410503863f82d0acb4251a7035b4e1123f51c92708bf7eccca1bfccbf7844cd2a820d6ce2f710

Download Submit
memory/2196-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2196-3-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2196-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2196-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2196-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2384-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2384-18-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2384-19-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2384-26-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download