84f5a67954d26e4e23bd497a719d299c2778c4b568e480d23e61e6e6fe08331b

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_5af901ecd859b54c82c26c7822d1a42f_cryptolocker.exe
Size

97KB
MD5

5af901ecd859b54c82c26c7822d1a42f
SHA1

65963cd1e7d52958ebafdbd00b017b345142e313
SHA256

84f5a67954d26e4e23bd497a719d299c2778c4b568e480d23e61e6e6fe08331b
SHA512

8b9ae8b6f9a22fa6c1e89b10915c815c923cf5205503c2eed816f9e057efb20ce730c19c011f66ba9b3058f96f9b1ea5bff51cc132a5c960d53643a7a55b4459
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWNa9mktJY8:xj+VGMOtEvwDpjubwQEIiVmks8

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2868-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2808-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2868-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2
behavioral1/memory/2808-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2868-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2808-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2868-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
C:\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1
behavioral1/memory/2808-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2868-0-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2808-16-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2868-15-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
C:\Users\Admin\AppData\Local\Temp\misid.exe	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2808-26-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2808 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-23_5af901ecd859b54c82c26c7822d1a42f_cryptolocker.exe

pid process

2868 2024-05-23_5af901ecd859b54c82c26c7822d1a42f_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2808	misid.exe

pid	process
2868	2024-05-23_5af901ecd859b54c82c26c7822d1a42f_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-23_5af901ecd859b54c82c26c7822d1a42f_cryptolocker.exe

description	pid	process	target process
PID 2868 wrote to memory of 2808	2868	2024-05-23_5af901ecd859b54c82c26c7822d1a42f_cryptolocker.exe	misid.exe
PID 2868 wrote to memory of 2808	2868	2024-05-23_5af901ecd859b54c82c26c7822d1a42f_cryptolocker.exe	misid.exe
PID 2868 wrote to memory of 2808	2868	2024-05-23_5af901ecd859b54c82c26c7822d1a42f_cryptolocker.exe	misid.exe
PID 2868 wrote to memory of 2808	2868	2024-05-23_5af901ecd859b54c82c26c7822d1a42f_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_5af901ecd859b54c82c26c7822d1a42f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_5af901ecd859b54c82c26c7822d1a42f_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2808

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
97KB

MD5
f241998c20f42ec5ca278b420125b2b3

SHA1
3cb0d9072cacb4aa6bad142eaa46ea21eb57d679

SHA256
4abcc14fad437529790ffed940bc1d1e77d46f8e42e367558305a559077821ab

SHA512
c1c0dcb068e104fcb74bb811394a6724e63f22da45b5756b988e14cb9f80bda465f6d2170ebd11c44d73702d5d5de64a4250a52b75e59070904255e63da7eb67

Download Submit
memory/2808-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2808-18-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2808-25-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2808-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2868-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2868-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2868-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2868-3-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2868-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download