53c65d17da2b98a8145b4dd1e29e89ddd18e9aedb9d389c9ad5ef6dda8aa570f

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-05-25_8dc10c16440a26f9cf52610d59becbcf_cryptolocker.exe
Size

53KB
MD5

8dc10c16440a26f9cf52610d59becbcf
SHA1

0854b7fe2ee46a97799244374cf8cb5c5be4b0f8
SHA256

53c65d17da2b98a8145b4dd1e29e89ddd18e9aedb9d389c9ad5ef6dda8aa570f
SHA512

046048b07e2c4c2a68c8ef06c1b68d49f690ed83ed4e00aa4499c08b0bb71bb092113da8f55e0259047236acdda1172ff3b8160420115c8b150a69c6c4e131eb
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhqlcnvhx5/xFRkHj:6j+1NMOtEvwDpjr8hhXiD

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 6 IoCs

resource	yara_rule
behavioral1/memory/2732-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c000000014c67-11.dat	CryptoLocker_rule2
behavioral1/memory/2732-12-0x0000000002480000-0x000000000248F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2732-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2628-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2628-27-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 6 IoCs

resource	yara_rule
behavioral1/memory/2732-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000c000000014c67-11.dat	CryptoLocker_set1
behavioral1/memory/2732-12-0x0000000002480000-0x000000000248F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2732-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2628-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2628-27-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 6 IoCs

resource	yara_rule
behavioral1/memory/2732-0-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x000c000000014c67-11.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2732-12-0x0000000002480000-0x000000000248F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2732-16-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2628-17-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2628-27-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

pid	Process
2628	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2732	2024-05-25_8dc10c16440a26f9cf52610d59becbcf_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2628	2732	2024-05-25_8dc10c16440a26f9cf52610d59becbcf_cryptolocker.exe	28
PID 2732 wrote to memory of 2628	2732	2024-05-25_8dc10c16440a26f9cf52610d59becbcf_cryptolocker.exe	28
PID 2732 wrote to memory of 2628	2732	2024-05-25_8dc10c16440a26f9cf52610d59becbcf_cryptolocker.exe	28
PID 2732 wrote to memory of 2628	2732	2024-05-25_8dc10c16440a26f9cf52610d59becbcf_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-25_8dc10c16440a26f9cf52610d59becbcf_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-25_8dc10c16440a26f9cf52610d59becbcf_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
53KB

MD5
fad293670dca65aa264698fbdbead488

SHA1
dbf37b03f436b8ba63116665c31628b3ddee54d0

SHA256
dcb182e25e8c4da6efef55eb8f9c1c8af2b38bad85559edb9b6e7a4d2e331052

SHA512
d9f1dee52d74e1d0aa0b4a4ab25d173eee1bb7fe6d07cb2466330a86aad2424133489a417b6e47d445df9a81555eeb27a66f9f1d1a914b475ecb4735cf72591e

Download Submit
memory/2628-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2628-26-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/2628-19-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download
memory/2628-27-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2732-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2732-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2732-2-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2732-3-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2732-12-0x0000000002480000-0x000000000248F000-memory.dmp

Filesize
60KB

Download
memory/2732-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download