27a0bf3c76c8328613e85b9a20ba3e6d2cdd98c50963c3d97e8989236ddb4928

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_222c02d067a4d06f0822d62b65c1c3e4_cryptolocker.exe
Size

48KB
MD5

222c02d067a4d06f0822d62b65c1c3e4
SHA1

df8a407a74cb78db7cd42a4de61314649399c912
SHA256

27a0bf3c76c8328613e85b9a20ba3e6d2cdd98c50963c3d97e8989236ddb4928
SHA512

f792af0a30147ccf65d9ea92d585d8a6b0922960db384eedc55ac63e1b68387a77504f380627e77c7e3fec8f8fbd83c8a00c5a027fbc015ce7a7655fce9d103f
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9RzhwaRhAj:xj+VGMOtEvwDpjy+TRhE

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/1848-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000b000000014abe-11.dat	CryptoLocker_rule2
behavioral1/memory/1848-13-0x0000000002840000-0x0000000002850000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1848-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2884-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/1848-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000b000000014abe-11.dat	CryptoLocker_set1
behavioral1/memory/1848-13-0x0000000002840000-0x0000000002850000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1848-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2884-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral1/memory/1848-0-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x000b000000014abe-11.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1848-13-0x0000000002840000-0x0000000002850000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1848-16-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2884-26-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

pid	Process
2884	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1848	2024-05-23_222c02d067a4d06f0822d62b65c1c3e4_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2884	1848	2024-05-23_222c02d067a4d06f0822d62b65c1c3e4_cryptolocker.exe	28
PID 1848 wrote to memory of 2884	1848	2024-05-23_222c02d067a4d06f0822d62b65c1c3e4_cryptolocker.exe	28
PID 1848 wrote to memory of 2884	1848	2024-05-23_222c02d067a4d06f0822d62b65c1c3e4_cryptolocker.exe	28
PID 1848 wrote to memory of 2884	1848	2024-05-23_222c02d067a4d06f0822d62b65c1c3e4_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-23_222c02d067a4d06f0822d62b65c1c3e4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_222c02d067a4d06f0822d62b65c1c3e4_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
48KB

MD5
7f9f2dce9e9e4cfdb9dafc5c06df7c90

SHA1
603d57c579498c01b4b0bfefe9146b1606432082

SHA256
1a74a6e0b9f614dc3cb02971cc036931f8d0c954cd6a1e06c316b9dd8e438a86

SHA512
3f7ababe73de015c597a44f7fec6859e4ddeda68993b163816992a580539c0e556bc01a69df2a0b32b9db38e983419636756a66391ab88e7353459ed49d2ab0d

Download Submit
memory/1848-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1848-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1848-2-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/1848-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1848-13-0x0000000002840000-0x0000000002850000-memory.dmp

Filesize
64KB

Download
memory/1848-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2884-18-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2884-25-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2884-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download