5b0d253d0a0c273eccef6cf3d678b69908a3a9e2f4a2062314bd50b6380f8342

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_9e1752a95c8a2f8f2afc5032772a25a1_cryptolocker.exe
Size

44KB
MD5

9e1752a95c8a2f8f2afc5032772a25a1
SHA1

8bd8d87e5eafffc0c968cafa19fff856842608e2
SHA256

5b0d253d0a0c273eccef6cf3d678b69908a3a9e2f4a2062314bd50b6380f8342
SHA512

536f5effa20a6c697e17529fb58d8afd21081ada1896d3f9c48e443a86b2cc2acd9c88e3f7374922acdd801c2a022ef470cc89f67a5d21be5bab2e792dd55d5b
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/aMDo:6j+1NMOtEvwDpjrRrU

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1804-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2
behavioral1/memory/1804-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/3068-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/3068-26-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1804-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1
behavioral1/memory/1804-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/3068-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/3068-26-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1804-0-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
\Users\Admin\AppData\Local\Temp\misid.exe	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1804-15-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/3068-16-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/3068-26-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

3068 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_9e1752a95c8a2f8f2afc5032772a25a1_cryptolocker.exe

pid process

1804 2024-05-22_9e1752a95c8a2f8f2afc5032772a25a1_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3068	misid.exe

pid	process
1804	2024-05-22_9e1752a95c8a2f8f2afc5032772a25a1_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_9e1752a95c8a2f8f2afc5032772a25a1_cryptolocker.exe

description	pid	process	target process
PID 1804 wrote to memory of 3068	1804	2024-05-22_9e1752a95c8a2f8f2afc5032772a25a1_cryptolocker.exe	misid.exe
PID 1804 wrote to memory of 3068	1804	2024-05-22_9e1752a95c8a2f8f2afc5032772a25a1_cryptolocker.exe	misid.exe
PID 1804 wrote to memory of 3068	1804	2024-05-22_9e1752a95c8a2f8f2afc5032772a25a1_cryptolocker.exe	misid.exe
PID 1804 wrote to memory of 3068	1804	2024-05-22_9e1752a95c8a2f8f2afc5032772a25a1_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_9e1752a95c8a2f8f2afc5032772a25a1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_9e1752a95c8a2f8f2afc5032772a25a1_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1804

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:3068

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
45KB

MD5
705d2b5809f90ca174996c2e08da8e06

SHA1
9db0bc13dfc4bb05469ed06f11c4f1527d0d138e

SHA256
14c380d5425f788f12ac73a6a7515e70013ec93ec383701bac52697bc9c636bf

SHA512
dae7fbe411395ad0850b115681e84e25b3f027816232b79a220177b9978fc467e030454f7644afb0e7d2dd0cbfb0cf913a814759075ee5503af1868af28aa70b

Download Submit
memory/1804-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1804-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1804-2-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1804-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1804-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3068-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3068-18-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/3068-25-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/3068-26-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download