85932fb45762996b75843ac0070727a2ac949444b9ed3d4baf0bb884cf60e1e8

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_7b560c15f88eaf4016a113fbc7e1a7c8_cryptolocker.exe
Size

96KB
MD5

7b560c15f88eaf4016a113fbc7e1a7c8
SHA1

e4e322c2dd7a7052d516fd3a10ac2f2b0511ef9b
SHA256

85932fb45762996b75843ac0070727a2ac949444b9ed3d4baf0bb884cf60e1e8
SHA512

38d7577f62cb199df82001b9962a9e7a5e68c3ab16032388f9609c0efe4fa8c4c43962ef226352b1479c18920d668c7765a190f933ba322b240edb1d2b7ba0e7
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRXrZSUfFKazNclMjNUvAce:xj+VGMOtEvwDpjubwQEI8UtzNcO8Ace

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2968-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2
behavioral1/memory/2968-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2968-15-0x0000000001E30000-0x0000000001E40000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2916-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2968-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1
behavioral1/memory/2968-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2916-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2968-0-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
\Users\Admin\AppData\Local\Temp\misid.exe	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2968-16-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2916-26-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2916 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-23_7b560c15f88eaf4016a113fbc7e1a7c8_cryptolocker.exe

pid process

2968 2024-05-23_7b560c15f88eaf4016a113fbc7e1a7c8_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2916	misid.exe

pid	process
2968	2024-05-23_7b560c15f88eaf4016a113fbc7e1a7c8_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-23_7b560c15f88eaf4016a113fbc7e1a7c8_cryptolocker.exe

description	pid	process	target process
PID 2968 wrote to memory of 2916	2968	2024-05-23_7b560c15f88eaf4016a113fbc7e1a7c8_cryptolocker.exe	misid.exe
PID 2968 wrote to memory of 2916	2968	2024-05-23_7b560c15f88eaf4016a113fbc7e1a7c8_cryptolocker.exe	misid.exe
PID 2968 wrote to memory of 2916	2968	2024-05-23_7b560c15f88eaf4016a113fbc7e1a7c8_cryptolocker.exe	misid.exe
PID 2968 wrote to memory of 2916	2968	2024-05-23_7b560c15f88eaf4016a113fbc7e1a7c8_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_7b560c15f88eaf4016a113fbc7e1a7c8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_7b560c15f88eaf4016a113fbc7e1a7c8_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
96KB

MD5
60ed0bd520462cd2048d1f214851ec2b

SHA1
d6252445708648772c3fc9c84debac8e48cd318b

SHA256
288aec8727b7ad375be1474f02f490dd6649fea0ed94a0443ad6f03a86d850ca

SHA512
8ee4992baa21d8e0a2d44a7878c22e36ce99fe639c989cbd96717b85ab060a0a1ba58e6965a167e6e723937dbe09c50ee869ce3d903f28ae8b25fa8a10e54b78

Download Submit
memory/2916-18-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2916-25-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2916-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2968-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2968-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2968-2-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2968-9-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2968-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2968-15-0x0000000001E30000-0x0000000001E40000-memory.dmp

Filesize
64KB

Download