594d97c0c626a82ed76a51a5a18c4c21a8bcd69e2108f96d9fab76ea6550bc8c

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-21_74dfbfd865fe6631e0a2e2c3a33ee9c5_cryptolocker.exe
Size

88KB
MD5

74dfbfd865fe6631e0a2e2c3a33ee9c5
SHA1

63e30fc874023071e9e0cff24ae98cd71aa633b6
SHA256

594d97c0c626a82ed76a51a5a18c4c21a8bcd69e2108f96d9fab76ea6550bc8c
SHA512

0365674430762187f2404764c6dba13c0f747f136170a9b71a43d65f76f7a57e64bd9f02759ee10103325eb05234b1c90229fc13c1641ccd26f14f85f42e298f
SSDEEP

768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRXrZSUfFKazNclMjNUvxpRvRF:i5nkFGMOtEvwDpjNbwQEI8UtzNcO8BRF

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2300-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2
behavioral1/memory/2300-13-0x0000000002840000-0x000000000284F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2300-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2080-27-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2300-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2080-27-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2300-0-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
\Users\Admin\AppData\Local\Temp\misid.exe	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2300-13-0x0000000002840000-0x000000000284F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2300-17-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2080-27-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2080 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-21_74dfbfd865fe6631e0a2e2c3a33ee9c5_cryptolocker.exe

pid process

2300 2024-05-21_74dfbfd865fe6631e0a2e2c3a33ee9c5_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2080	misid.exe

pid	process
2300	2024-05-21_74dfbfd865fe6631e0a2e2c3a33ee9c5_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-21_74dfbfd865fe6631e0a2e2c3a33ee9c5_cryptolocker.exe

description	pid	process	target process
PID 2300 wrote to memory of 2080	2300	2024-05-21_74dfbfd865fe6631e0a2e2c3a33ee9c5_cryptolocker.exe	misid.exe
PID 2300 wrote to memory of 2080	2300	2024-05-21_74dfbfd865fe6631e0a2e2c3a33ee9c5_cryptolocker.exe	misid.exe
PID 2300 wrote to memory of 2080	2300	2024-05-21_74dfbfd865fe6631e0a2e2c3a33ee9c5_cryptolocker.exe	misid.exe
PID 2300 wrote to memory of 2080	2300	2024-05-21_74dfbfd865fe6631e0a2e2c3a33ee9c5_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_74dfbfd865fe6631e0a2e2c3a33ee9c5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_74dfbfd865fe6631e0a2e2c3a33ee9c5_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2300

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
88KB

MD5
2a1a1faf8df6ff3c23f0ff05e0c038d5

SHA1
9f1cbc7d150fbecae57582a87fdd147b71b03e08

SHA256
529dd5fcf9baa0d11b9db0ad90dbdf76ca58b3e4b74faaa734f6145d5503bfa9

SHA512
6bb5564efd31a4dd09ab91c9158d4fdc19a53bf5deea20e1d04bdc3f59f630af16634030e5dc2b372e8fdc49268ab81b5f8cec4b49273da90d467d46ca3e2bd9

Download Submit
memory/2080-19-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2080-26-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2080-27-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2300-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2300-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2300-2-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/2300-9-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2300-13-0x0000000002840000-0x000000000284F000-memory.dmp

Filesize
60KB

Download
memory/2300-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download