416d5dde16e16b755d1e8890811bf678a7dd2c335b84023a75919dd7c4a0ad9d

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 04:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-24_ddcca020067bbb9a2f4bcd82c9737a3b_cryptolocker.exe
Size

95KB
MD5

ddcca020067bbb9a2f4bcd82c9737a3b
SHA1

603ac1e5430904cb4dea1773648162873c396c09
SHA256

416d5dde16e16b755d1e8890811bf678a7dd2c335b84023a75919dd7c4a0ad9d
SHA512

8f1a3defe5213445ef637ebc314ce9a46b8c49132f24cd3dbad63a3d6e18085678a27cdce818ab9a3afa5391d185be80205e69652c52a25e171900dd485b042e
SSDEEP

1536:zj+soPSMOtEvwDpj4ktBl01hJl8QAPM8Ho6cRDjgx/kg:zCsanOtEvwDpjBT

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1288-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2
behavioral1/memory/1288-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2972-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2972-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1288-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1
behavioral1/memory/1288-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2972-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2972-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1288-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
\Users\Admin\AppData\Local\Temp\misid.exe	UPX
behavioral1/memory/1288-15-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2972-16-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2972-25-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2972 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-24_ddcca020067bbb9a2f4bcd82c9737a3b_cryptolocker.exe

pid process

1288 2024-05-24_ddcca020067bbb9a2f4bcd82c9737a3b_cryptolocker.exe

pid	process
2972	misid.exe

pid	process
1288	2024-05-24_ddcca020067bbb9a2f4bcd82c9737a3b_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1288-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\misid.exe	upx
behavioral1/memory/1288-15-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2972-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2972-25-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-24_ddcca020067bbb9a2f4bcd82c9737a3b_cryptolocker.exe

description	pid	process	target process
PID 1288 wrote to memory of 2972	1288	2024-05-24_ddcca020067bbb9a2f4bcd82c9737a3b_cryptolocker.exe	misid.exe
PID 1288 wrote to memory of 2972	1288	2024-05-24_ddcca020067bbb9a2f4bcd82c9737a3b_cryptolocker.exe	misid.exe
PID 1288 wrote to memory of 2972	1288	2024-05-24_ddcca020067bbb9a2f4bcd82c9737a3b_cryptolocker.exe	misid.exe
PID 1288 wrote to memory of 2972	1288	2024-05-24_ddcca020067bbb9a2f4bcd82c9737a3b_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-24_ddcca020067bbb9a2f4bcd82c9737a3b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_ddcca020067bbb9a2f4bcd82c9737a3b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1288

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
95KB

MD5
dce9e77fc22ac66b96e20ee65ad1c450

SHA1
2eac5abed6125eb4a3bc2962a76f4c83ebf480dd

SHA256
3bb1456adafa7e682f5f8eae68eabfc3e633bc9c2e5141bd3b291893aff27429

SHA512
a9717503a95795619ca1df2d500eae51f6397aedfb6969bd3a58d8cff3d231725c4b105073f91af926ca07572e2eaff06494880b479e8172af72c9d4f4a9737b

Download Submit
memory/1288-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1288-2-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1288-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1288-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1288-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2972-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2972-18-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2972-25-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download