7e137eb41d5ba35c888a3c840b82d3ce74652347a55da3eb2f79b8dd2575aa5d

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_a5bc26a0676d8f02b74f7a98fa871b98_cryptolocker.exe
Size

69KB
MD5

a5bc26a0676d8f02b74f7a98fa871b98
SHA1

78cb6ac98c3dbb88eb5788606c6de41fc5935c7b
SHA256

7e137eb41d5ba35c888a3c840b82d3ce74652347a55da3eb2f79b8dd2575aa5d
SHA512

a35037f1efeecfcbe80241d656c30659b32693a9a16248fbc215e38f61c6fe4b63de60a6ca766664356ef03c098ab53da53cd815fcc7260995ebcef5d5ab3211
SSDEEP

768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRXrZSUNsYD/dG:i5nkFGMOtEvwDpjNbwQEI8UZDw

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2916-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2
behavioral1/memory/3056-18-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2916-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/3056-28-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2916-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/3056-28-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2916-0-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
\Users\Admin\AppData\Local\Temp\misid.exe	INDICATOR_EXE_Packed_MPress
behavioral1/memory/3056-18-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2916-17-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/3056-28-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

3056 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_a5bc26a0676d8f02b74f7a98fa871b98_cryptolocker.exe

pid process

2916 2024-05-22_a5bc26a0676d8f02b74f7a98fa871b98_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3056	misid.exe

pid	process
2916	2024-05-22_a5bc26a0676d8f02b74f7a98fa871b98_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_a5bc26a0676d8f02b74f7a98fa871b98_cryptolocker.exe

description	pid	process	target process
PID 2916 wrote to memory of 3056	2916	2024-05-22_a5bc26a0676d8f02b74f7a98fa871b98_cryptolocker.exe	misid.exe
PID 2916 wrote to memory of 3056	2916	2024-05-22_a5bc26a0676d8f02b74f7a98fa871b98_cryptolocker.exe	misid.exe
PID 2916 wrote to memory of 3056	2916	2024-05-22_a5bc26a0676d8f02b74f7a98fa871b98_cryptolocker.exe	misid.exe
PID 2916 wrote to memory of 3056	2916	2024-05-22_a5bc26a0676d8f02b74f7a98fa871b98_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_a5bc26a0676d8f02b74f7a98fa871b98_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_a5bc26a0676d8f02b74f7a98fa871b98_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:3056

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
69KB

MD5
848635650b13ec1a32824f06415acc6a

SHA1
6128c447a8f2a1726ce6423d5ea57d79428950ca

SHA256
de56af0dae85473bc7576333b256d902a7eb99cedda7fb0da607f19e5a03c317

SHA512
e049f8bc9578facee0fa794f9be57d8696478fa6078527982c74d399f9a0e0035c4ad6de11f1e920cda7b508138689b35fd5e051566fd00cf9a98005ebaeb712

Download Submit
memory/2916-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2916-1-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2916-9-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2916-2-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2916-13-0x00000000006D0000-0x00000000006DF000-memory.dmp

Filesize
60KB

Download
memory/2916-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3056-20-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/3056-18-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3056-27-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3056-28-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download