19f26500b4e1d24bf3c292aaa62772cb2f596c3d330f80749afc5283a48a35d3

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_1f5a1a41a2282f5431b5b1cb53625088_cryptolocker.exe
Size

42KB
MD5

1f5a1a41a2282f5431b5b1cb53625088
SHA1

41d2c22300135253bb17ce811986aa86621cca91
SHA256

19f26500b4e1d24bf3c292aaa62772cb2f596c3d330f80749afc5283a48a35d3
SHA512

61be41db22dec8ffbe3f495b5033a727dbbe426098b993f80245521563e2f315df2fa5ddd27cd4fa72edae6c4102e1fc1056e3da3f93eeaa1465512e4aad1491
SSDEEP

768:XS5nQJ24LR1bytOOtEvwDpj66BLbjG9Rva/yYshNhV:i5nkFGMOtEvwDpjR+viHshND

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3036-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2
behavioral1/memory/3036-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2904-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2904-27-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3036-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/3036-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2904-27-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3036-0-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
\Users\Admin\AppData\Local\Temp\misid.exe	INDICATOR_EXE_Packed_MPress
behavioral1/memory/3036-15-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2904-17-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2904-27-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2904 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-23_1f5a1a41a2282f5431b5b1cb53625088_cryptolocker.exe

pid process

3036 2024-05-23_1f5a1a41a2282f5431b5b1cb53625088_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2904	misid.exe

pid	process
3036	2024-05-23_1f5a1a41a2282f5431b5b1cb53625088_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-23_1f5a1a41a2282f5431b5b1cb53625088_cryptolocker.exe

description	pid	process	target process
PID 3036 wrote to memory of 2904	3036	2024-05-23_1f5a1a41a2282f5431b5b1cb53625088_cryptolocker.exe	misid.exe
PID 3036 wrote to memory of 2904	3036	2024-05-23_1f5a1a41a2282f5431b5b1cb53625088_cryptolocker.exe	misid.exe
PID 3036 wrote to memory of 2904	3036	2024-05-23_1f5a1a41a2282f5431b5b1cb53625088_cryptolocker.exe	misid.exe
PID 3036 wrote to memory of 2904	3036	2024-05-23_1f5a1a41a2282f5431b5b1cb53625088_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_1f5a1a41a2282f5431b5b1cb53625088_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_1f5a1a41a2282f5431b5b1cb53625088_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2904

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
42KB

MD5
f5e033a72b2d56052ed7c90b34a76a5a

SHA1
28b5a12abf4bc40cd8e658f81ebe4a93b10b82af

SHA256
5ddb07e95cf11842119b4cbfe352848c9bcf218855a0ade89e1c3b6e1e361380

SHA512
4c2273de0687d3e87eac1bdbd2e0286777cad33b70853122cc124f7fb7ff9c50baa8783c8c24d3d3ae692d15d1eceedcd52d5a5433b4200fdfdffba4fc16667c

Download Submit
memory/2904-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2904-19-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2904-26-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/2904-27-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3036-2-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/3036-9-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/3036-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/3036-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3036-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download