26ca0dc74975b768c6180561acb2d1533b9b5eca9d14991e7cb32c8b14d7a874

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-26_1d3366c51279f193a27882d3469ee432_cryptolocker.exe
Size

42KB
MD5

1d3366c51279f193a27882d3469ee432
SHA1

76f828a60a8f0ac3b767db60b6a7333c8c23d81c
SHA256

26ca0dc74975b768c6180561acb2d1533b9b5eca9d14991e7cb32c8b14d7a874
SHA512

cc9f57b3be0eff0bc002fa54702a8cb31eba807618cd512bc933ba0326807d4c8ad311ce865d5dda77f250e35c90ea640ae54caf284aa61c26f8a85f1c6f9bd1
SSDEEP

768:XS5nQJ24LR1bytOOtEvwDpj66BLbjG9Rva/yYshNhfB:i5nkFGMOtEvwDpjR+viHshN5B

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/1996-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c000000012279-11.dat	CryptoLocker_rule2
behavioral1/memory/1996-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1052-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1052-26-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 2 IoCs

resource	yara_rule
behavioral1/memory/1996-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1052-26-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral1/memory/1996-0-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x000c000000012279-11.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1996-16-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1052-17-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1052-26-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

pid	Process
1052	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1996	2024-05-26_1d3366c51279f193a27882d3469ee432_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1052	1996	2024-05-26_1d3366c51279f193a27882d3469ee432_cryptolocker.exe	28
PID 1996 wrote to memory of 1052	1996	2024-05-26_1d3366c51279f193a27882d3469ee432_cryptolocker.exe	28
PID 1996 wrote to memory of 1052	1996	2024-05-26_1d3366c51279f193a27882d3469ee432_cryptolocker.exe	28
PID 1996 wrote to memory of 1052	1996	2024-05-26_1d3366c51279f193a27882d3469ee432_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-26_1d3366c51279f193a27882d3469ee432_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-26_1d3366c51279f193a27882d3469ee432_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
42KB

MD5
533544924ac986a70581e16211e91b99

SHA1
45b8f3f379fac431ae7fca0e2d2be20feca2b593

SHA256
e27ac8bf04d398b9f71b7780d6fb060c9ed59346db5c80c949df791e44478c06

SHA512
d1219129acf7e69f10883954e05f122a01ce6e2a60575ea5aff3e400807201026281bbcdf576ede869132cbdbec5732d0816b37592c09e2702aac1fdc422ca8c

Download Submit
memory/1052-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1052-26-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1996-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1996-2-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/1996-1-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1996-9-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1996-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download