996640bdc2e1387cb545be3db20ca8e4ff5085544586fe5e52710f4cb5d0ec8e

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-21_fce3f4ffbdb7bf126a43adaa07b51073_cryptolocker.exe
Size

48KB
MD5

fce3f4ffbdb7bf126a43adaa07b51073
SHA1

77f80819692755cccb144e0234afeedaa9e9718b
SHA256

996640bdc2e1387cb545be3db20ca8e4ff5085544586fe5e52710f4cb5d0ec8e
SHA512

042c13f63e5bfe498086accf2db1ef79c3ec5ed937c0342947a8df01937309b78b17b41e9a9842f873d47c11db7be0d0a28fc3038aa693719bbbff10149619bd
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9RzhwaRh+Epc:xj+VGMOtEvwDpjy+TRh+Eu

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2032-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2
behavioral1/memory/2828-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2032-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2828-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2032-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1
behavioral1/memory/2828-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2032-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2828-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2032-0-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
\Users\Admin\AppData\Local\Temp\misid.exe	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2828-16-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2032-15-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2828-26-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2828 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-21_fce3f4ffbdb7bf126a43adaa07b51073_cryptolocker.exe

pid process

2032 2024-05-21_fce3f4ffbdb7bf126a43adaa07b51073_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2828	misid.exe

pid	process
2032	2024-05-21_fce3f4ffbdb7bf126a43adaa07b51073_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-21_fce3f4ffbdb7bf126a43adaa07b51073_cryptolocker.exe

description	pid	process	target process
PID 2032 wrote to memory of 2828	2032	2024-05-21_fce3f4ffbdb7bf126a43adaa07b51073_cryptolocker.exe	misid.exe
PID 2032 wrote to memory of 2828	2032	2024-05-21_fce3f4ffbdb7bf126a43adaa07b51073_cryptolocker.exe	misid.exe
PID 2032 wrote to memory of 2828	2032	2024-05-21_fce3f4ffbdb7bf126a43adaa07b51073_cryptolocker.exe	misid.exe
PID 2032 wrote to memory of 2828	2032	2024-05-21_fce3f4ffbdb7bf126a43adaa07b51073_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_fce3f4ffbdb7bf126a43adaa07b51073_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_fce3f4ffbdb7bf126a43adaa07b51073_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2032

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
48KB

MD5
efaf005b9f7c0fc010dc251d73706e9e

SHA1
83183add4014182369ab88436c17f8abe993f2d5

SHA256
20ad7c207f5bf51bee74260c470b78add55db1a2cd2f1c2e9e2287a15ea57145

SHA512
0f917d5bf46e0e9bc370a8988a2d1a62b63f1f39b358c452674255dbf5fcde39406e798fe38609510fbcccb026d3c658391795926e80fb1ad5ebccc2087cb31d

Download Submit
memory/2032-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2032-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2032-2-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2032-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2032-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2828-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2828-25-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2828-18-0x00000000004C0000-0x00000000004C6000-memory.dmp

Filesize
24KB

Download
memory/2828-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download