9753932ae0403472f5e175eb38d560c61cf73ae3af55c3ec8ddcd5b3eec331ae

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_240332263e3a7c8f4a3057bd3a5fb9aa_cryptolocker.exe
Size

96KB
MD5

240332263e3a7c8f4a3057bd3a5fb9aa
SHA1

6e24e48929e3c45b9aa9c211e70b4ba7424ca17d
SHA256

9753932ae0403472f5e175eb38d560c61cf73ae3af55c3ec8ddcd5b3eec331ae
SHA512

a10b2434c7eb498d8748b6e5771a1b86a96be41012d2bec1f445c8cc54f7f3d1400cfac612b6c5bcbb00b7d998b238a0e0b81f23b33febd1c7f8cd83a5fa2eba
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRXrZSUfFKazNclMjNUvAcT:xj+VGMOtEvwDpjubwQEI8UtzNcO8AcT

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2236-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2
behavioral1/memory/2236-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2812-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2236-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1
behavioral1/memory/2236-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2812-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2236-0-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
\Users\Admin\AppData\Local\Temp\misid.exe	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2236-15-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2812-25-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2812 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-23_240332263e3a7c8f4a3057bd3a5fb9aa_cryptolocker.exe

pid process

2236 2024-05-23_240332263e3a7c8f4a3057bd3a5fb9aa_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2812	misid.exe

pid	process
2236	2024-05-23_240332263e3a7c8f4a3057bd3a5fb9aa_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-23_240332263e3a7c8f4a3057bd3a5fb9aa_cryptolocker.exe

description	pid	process	target process
PID 2236 wrote to memory of 2812	2236	2024-05-23_240332263e3a7c8f4a3057bd3a5fb9aa_cryptolocker.exe	misid.exe
PID 2236 wrote to memory of 2812	2236	2024-05-23_240332263e3a7c8f4a3057bd3a5fb9aa_cryptolocker.exe	misid.exe
PID 2236 wrote to memory of 2812	2236	2024-05-23_240332263e3a7c8f4a3057bd3a5fb9aa_cryptolocker.exe	misid.exe
PID 2236 wrote to memory of 2812	2236	2024-05-23_240332263e3a7c8f4a3057bd3a5fb9aa_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_240332263e3a7c8f4a3057bd3a5fb9aa_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_240332263e3a7c8f4a3057bd3a5fb9aa_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2812

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
96KB

MD5
8d722de688b20d43668fbaa9991f7c38

SHA1
f0dde3401c4fb999be1bc51a153cff913e232a2f

SHA256
e0f8a340ddd1ea71c730856da0fb11dbdff4c20ab2e6adba6b4a37046eb68d5c

SHA512
67ce08316552cdf0ed9cf706d0ebf98f7610f51eb389fc996ad186ed08389359bea4bb826ad6b95697ba35be3c307374fc120662866a49ae3242ebcb78fb1f1b

Download Submit
memory/2236-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2236-1-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2236-2-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2236-9-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2236-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2812-17-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2812-18-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2812-25-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download