22c14bd747ddfcd8a0a61bc473c7fcd4326f26c42798cc84ba58863fef7692b0

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-24_244fe998850ac1edf4a64bc8f44adad9_cryptolocker.exe
Size

69KB
MD5

244fe998850ac1edf4a64bc8f44adad9
SHA1

797d4429f18ab4fa0c5d6d6da936c454c4f6524b
SHA256

22c14bd747ddfcd8a0a61bc473c7fcd4326f26c42798cc84ba58863fef7692b0
SHA512

94ffea9866235469b40ef4067381306827aeceb4cd97d8908a6e21e568f2c0fa7212bc5374e9d6cec8e930670f9f984467b0a610f0fe1d81d8247925c2067972
SSDEEP

1536:nj+4zs2cPVhlMOtEvwDpj4H8u8rZVTs9c:C4Q2c94OtEvwDpj4H8zl

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3048-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2
behavioral1/memory/2076-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2076-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/3048-27-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3048-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2076-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/3048-27-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3048-17-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
C:\Users\Admin\AppData\Local\Temp\misid.exe	UPX
behavioral1/memory/2076-16-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2076-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/3048-27-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

3048 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-24_244fe998850ac1edf4a64bc8f44adad9_cryptolocker.exe

pid process

2076 2024-05-24_244fe998850ac1edf4a64bc8f44adad9_cryptolocker.exe

pid	process
3048	misid.exe

pid	process
2076	2024-05-24_244fe998850ac1edf4a64bc8f44adad9_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3048-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\misid.exe	upx
behavioral1/memory/2076-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2076-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/3048-27-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-24_244fe998850ac1edf4a64bc8f44adad9_cryptolocker.exe

description	pid	process	target process
PID 2076 wrote to memory of 3048	2076	2024-05-24_244fe998850ac1edf4a64bc8f44adad9_cryptolocker.exe	misid.exe
PID 2076 wrote to memory of 3048	2076	2024-05-24_244fe998850ac1edf4a64bc8f44adad9_cryptolocker.exe	misid.exe
PID 2076 wrote to memory of 3048	2076	2024-05-24_244fe998850ac1edf4a64bc8f44adad9_cryptolocker.exe	misid.exe
PID 2076 wrote to memory of 3048	2076	2024-05-24_244fe998850ac1edf4a64bc8f44adad9_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-24_244fe998850ac1edf4a64bc8f44adad9_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_244fe998850ac1edf4a64bc8f44adad9_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2076

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:3048

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
70KB

MD5
2477d4d57bbf41523a46670f377e7858

SHA1
5eaf9188f4bd49edd5e56b162b766aec77b64167

SHA256
a0912d0608aa1e061356ab51b112dd01df857f4a5a4d041944eb539987cdc00a

SHA512
b7fa4cd730dd90b7e94cf503e805058a8dc85ef11e253dc536fcb9e0c79e716dc2a51c091297d49b41c13b0cc67597de35b979a03849faff00b0ab3fc70ec2ab

Download Submit
memory/2076-2-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2076-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2076-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2076-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2076-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3048-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3048-26-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3048-19-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/3048-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download