9f02043c532779a3306c5229ab0282820095e9c0e2580b2f30f347a6892866a7

Analysis

max time kernel
147s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 23:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-14_517c9bfe0950d408cb19cc902427cf8d_cryptolocker.exe
Size

56KB
MD5

517c9bfe0950d408cb19cc902427cf8d
SHA1

498acad437f2abc6a055709e700c94112ead6cf0
SHA256

9f02043c532779a3306c5229ab0282820095e9c0e2580b2f30f347a6892866a7
SHA512

f8a29cddab64ba2bc512f50be1b5fd983938771c354f1672040904f8db9e0185f3f38fd0c99a823061cace40902c617b6e146865216498ad865e2f7a3c0f1444
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5QJz7/e6B:6j+1NMOtEvwDpjr8oxExe6B

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/640-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x0009000000014738-11.dat	CryptoLocker_rule2
behavioral1/memory/640-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1720-25-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/640-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x0009000000014738-11.dat	CryptoLocker_set1
behavioral1/memory/640-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1720-25-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 4 IoCs

resource	yara_rule
behavioral1/memory/640-0-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x0009000000014738-11.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/640-15-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1720-25-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

pid	Process
1720	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
640	2024-05-14_517c9bfe0950d408cb19cc902427cf8d_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 1720	640	2024-05-14_517c9bfe0950d408cb19cc902427cf8d_cryptolocker.exe	28
PID 640 wrote to memory of 1720	640	2024-05-14_517c9bfe0950d408cb19cc902427cf8d_cryptolocker.exe	28
PID 640 wrote to memory of 1720	640	2024-05-14_517c9bfe0950d408cb19cc902427cf8d_cryptolocker.exe	28
PID 640 wrote to memory of 1720	640	2024-05-14_517c9bfe0950d408cb19cc902427cf8d_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-14_517c9bfe0950d408cb19cc902427cf8d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-14_517c9bfe0950d408cb19cc902427cf8d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:640
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
56KB

MD5
2a85eb6871dfb670685d5f2522efc347

SHA1
7661bee5b9d93b26f8626ed20bcfccb9972396da

SHA256
4ac5da30bf950debdf423dc64d015e31b476d4882ae2ff7ad1f3b872d0030875

SHA512
5494af2fb02d4f6acac0a99bd6f55ca12e143788fd9e7c7c5dc101d3b5268f71a4a6c9a86c59ca02c7f61e788daca19d102459c5ef6a63f806a761fc63600e13

Download Submit
memory/640-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/640-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/640-2-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/640-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/640-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1720-24-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1720-17-0x00000000002E0000-0x00000000002E6000-memory.dmp

Filesize
24KB

Download
memory/1720-25-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download