5b33d280053eb47e0fbed728f425667cca2a6fd16656c336a1575d51010c3311

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-15_209b99efd6a83c05fe7df85743fdb7b9_cryptolocker.exe
Size

43KB
MD5

209b99efd6a83c05fe7df85743fdb7b9
SHA1

480dfc12c262829b002e7ca03310a6daee90531c
SHA256

5b33d280053eb47e0fbed728f425667cca2a6fd16656c336a1575d51010c3311
SHA512

6f387326f6b5afe1a3972f8c71678d32e57c39e65162973632b77ef70ca8e542613f5e61d61803587b90038f91a5e2be23bdadb542c19d4b7a3ab6e759df829a
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/CtXabMwj:6j+1NMOtEvwDpjrR2XabMwj

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000155e2-24.dat	CryptoLocker_rule2
behavioral1/memory/2900-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1368-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1368-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2900-26-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000155e2-24.dat	CryptoLocker_set1
behavioral1/memory/2900-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1368-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1368-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2900-26-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000155e2-24.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2900-16-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1368-15-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1368-0-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2900-26-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

pid	Process
2900	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1368	2024-05-15_209b99efd6a83c05fe7df85743fdb7b9_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2900	1368	2024-05-15_209b99efd6a83c05fe7df85743fdb7b9_cryptolocker.exe	28
PID 1368 wrote to memory of 2900	1368	2024-05-15_209b99efd6a83c05fe7df85743fdb7b9_cryptolocker.exe	28
PID 1368 wrote to memory of 2900	1368	2024-05-15_209b99efd6a83c05fe7df85743fdb7b9_cryptolocker.exe	28
PID 1368 wrote to memory of 2900	1368	2024-05-15_209b99efd6a83c05fe7df85743fdb7b9_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-15_209b99efd6a83c05fe7df85743fdb7b9_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-15_209b99efd6a83c05fe7df85743fdb7b9_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
43KB

MD5
0f9a133317046fbc1935db236dc4b512

SHA1
681d7b7453006675f1099d84c2d0489779027ff7

SHA256
2d6529dae1e12a6563a127ebf25578d4c31b4c466435dd07dd375232d62c2d46

SHA512
d0da21659b2eb3240d1e1a46d186ebd47891fae1b8da20770815adf2d3769cfc0b59330291fbd79e62ac7b892ef9b4446235f05ac6d65dc4e76970ba10fe3f0f

Download Submit
memory/1368-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1368-8-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1368-2-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/1368-1-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1368-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2900-25-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2900-18-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2900-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2900-26-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download