f77de7e1d0ab9b15cf6da101f67b9bc81749fd42cd37cb11f0dcc1ffc4846161

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-21_55024c56ce26804ec196a7f2787ef2c3_cryptolocker.exe
Size

42KB
MD5

55024c56ce26804ec196a7f2787ef2c3
SHA1

f77464b7932f2dc4af352082acf8e991b1935248
SHA256

f77de7e1d0ab9b15cf6da101f67b9bc81749fd42cd37cb11f0dcc1ffc4846161
SHA512

1caa69fbc5d9cc4f69f83b05fb21ee8f962c236a1d80ddff54a40e2e17f8c02bf14bed33957bece213fd6f465cb1a8563b6e9bdcf30eead36d80268f08ac5414
SSDEEP

768:XS5nQJ24LR1bytOOtEvwDpj66BLbjG9Rva/yYsZnU:i5nkFGMOtEvwDpjR+viHsW

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/1964-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c00000001565d-11.dat	CryptoLocker_rule2
behavioral1/memory/1964-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2828-26-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 2 IoCs

resource	yara_rule
behavioral1/memory/1964-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2828-26-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 4 IoCs

resource	yara_rule
behavioral1/memory/1964-0-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x000c00000001565d-11.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1964-16-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2828-26-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

pid	Process
2828	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1964	2024-05-21_55024c56ce26804ec196a7f2787ef2c3_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2828	1964	2024-05-21_55024c56ce26804ec196a7f2787ef2c3_cryptolocker.exe	28
PID 1964 wrote to memory of 2828	1964	2024-05-21_55024c56ce26804ec196a7f2787ef2c3_cryptolocker.exe	28
PID 1964 wrote to memory of 2828	1964	2024-05-21_55024c56ce26804ec196a7f2787ef2c3_cryptolocker.exe	28
PID 1964 wrote to memory of 2828	1964	2024-05-21_55024c56ce26804ec196a7f2787ef2c3_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-21_55024c56ce26804ec196a7f2787ef2c3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_55024c56ce26804ec196a7f2787ef2c3_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
42KB

MD5
8886fbbbbe16a05005faf7ee0f62f1c3

SHA1
363dbd8cebf3837f7e9f69479b77e4db5fbbfd1f

SHA256
a194d9dbc241c02c8f4f20581d8fe2450ec2d9163075c10b3432e6f54672913a

SHA512
1cfcf219d64ad9d9aa5408666dd390724478a9bf7a3284231384e2cf9f16baad6df42958bad0fa1256c0b8aeb40899cb2b7cc5e5985f00a830a682a719c7406b

Download Submit
memory/1964-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1964-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1964-2-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/1964-9-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1964-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2828-18-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2828-26-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2828-25-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download