135decb37049509861fa89774c73975ed842228001cdf63fdde54ee565d47a9d

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-01_89398290a5fb395b597f916688b91de3_cryptolocker.exe
Size

69KB
MD5

89398290a5fb395b597f916688b91de3
SHA1

9b174767085a3afd414b3080c4525a214bef6c81
SHA256

135decb37049509861fa89774c73975ed842228001cdf63fdde54ee565d47a9d
SHA512

64b4ae4c0b2ad8f28fbf5935aaca0c68c4338273de7d88c3a03b42f946807bb52026d5b5694cf5ff4da2ef30969f0b5463d101c4fef27027c7b363d10e84b2f1
SSDEEP

768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRXrZSUNsYD/d8X9:i5nkFGMOtEvwDpjNbwQEI8UZDet

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/996-1-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x00080000000122cd-15.dat	CryptoLocker_rule2
behavioral1/memory/2496-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2496-25-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 2 IoCs

resource	yara_rule
behavioral1/memory/996-1-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2496-25-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 4 IoCs

resource	yara_rule
behavioral1/memory/996-1-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x00080000000122cd-15.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2496-16-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2496-25-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

pid	Process
2496	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
996	2024-06-01_89398290a5fb395b597f916688b91de3_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 2496	996	2024-06-01_89398290a5fb395b597f916688b91de3_cryptolocker.exe	28
PID 996 wrote to memory of 2496	996	2024-06-01_89398290a5fb395b597f916688b91de3_cryptolocker.exe	28
PID 996 wrote to memory of 2496	996	2024-06-01_89398290a5fb395b597f916688b91de3_cryptolocker.exe	28
PID 996 wrote to memory of 2496	996	2024-06-01_89398290a5fb395b597f916688b91de3_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-01_89398290a5fb395b597f916688b91de3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_89398290a5fb395b597f916688b91de3_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:996
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
70KB

MD5
c05425ee08446d3be4ef329468dfad94

SHA1
5580c498b31102d9fb0b391a5af84373b7abc517

SHA256
1a5576706f7f0556eaa1072dafe5399b53b0f1dddcd791ab9e5c6335eb3bb249

SHA512
6c46397bfdfb1cb4690e041868900c804643bd55fb59e5f0444e8a8031386b8ed4e76b585f1842db58101a15d5acc1e30639a138696b7666e1e281844a65dc88

Download Submit
memory/996-7-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/996-2-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/996-1-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/996-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2496-18-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2496-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2496-25-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download