0e39192616e6b8afce47c03fe13d3bb6877c6017b9d649c51786eba796a0640d

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-21_61f1d27da5ccdabfb55cbf301804945b_cryptolocker.exe
Size

44KB
MD5

61f1d27da5ccdabfb55cbf301804945b
SHA1

cf9ed1bbf4144a664c2b480ae3f7552497785d2f
SHA256

0e39192616e6b8afce47c03fe13d3bb6877c6017b9d649c51786eba796a0640d
SHA512

d65e1f290087aed450b667f4310924c890fe78cff0ea855d216792767771f364df287c939d5d94e575093e804d4b25ceea4bbb1df2e9bb4fa8ca0202df15a8ec
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/CtXabM0Dl:6j+1NMOtEvwDpjrR2XabMQl

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1040-1-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2
behavioral1/memory/1040-14-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2476-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2476-26-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1040-1-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1
behavioral1/memory/1040-14-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2476-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2476-26-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1040-1-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
\Users\Admin\AppData\Local\Temp\misid.exe	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1040-14-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2476-17-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2476-26-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2476 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-21_61f1d27da5ccdabfb55cbf301804945b_cryptolocker.exe

pid process

1040 2024-05-21_61f1d27da5ccdabfb55cbf301804945b_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2476	misid.exe

pid	process
1040	2024-05-21_61f1d27da5ccdabfb55cbf301804945b_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-21_61f1d27da5ccdabfb55cbf301804945b_cryptolocker.exe

description	pid	process	target process
PID 1040 wrote to memory of 2476	1040	2024-05-21_61f1d27da5ccdabfb55cbf301804945b_cryptolocker.exe	misid.exe
PID 1040 wrote to memory of 2476	1040	2024-05-21_61f1d27da5ccdabfb55cbf301804945b_cryptolocker.exe	misid.exe
PID 1040 wrote to memory of 2476	1040	2024-05-21_61f1d27da5ccdabfb55cbf301804945b_cryptolocker.exe	misid.exe
PID 1040 wrote to memory of 2476	1040	2024-05-21_61f1d27da5ccdabfb55cbf301804945b_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_61f1d27da5ccdabfb55cbf301804945b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_61f1d27da5ccdabfb55cbf301804945b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1040

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
44KB

MD5
20ec61392b997305f0d2a67e5cf9dc44

SHA1
d1245d8fda9694d014b32854b2f7ea5669fdabc0

SHA256
013792a3b31ff6daae7c6ed5a320daf42626c97295a8f0a4e1fbf3e434e34fcc

SHA512
ab2aca210d90e4963cdb014027d87fce316b7ca3d07a11e3dcb59a992378ab4d6f28918746b66fcab821efcac2d8d2dc94e435c1b61458da35aa6d1e2711f0e8

Download Submit
memory/1040-1-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1040-0-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/1040-2-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/1040-9-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/1040-14-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2476-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2476-18-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2476-25-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2476-26-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download