7c29a6cfa27534225e95f2b3914a210ba1bb5c694fd289a66973c8214a83c64d

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 19:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-06_91cf5b2c40f9b82584bda0b57bb5d83d_cryptolocker.exe
Size

62KB
MD5

91cf5b2c40f9b82584bda0b57bb5d83d
SHA1

67fa061062191ebfc91e599ba70f88ec3d6f0cae
SHA256

7c29a6cfa27534225e95f2b3914a210ba1bb5c694fd289a66973c8214a83c64d
SHA512

5be084a026b81f17f4b38ace7621f710bfe0930687ec511ea0d4c48c26fd3f8cc82ad4fa749a64398ec685a26b1fdd44262dbb7d3007789ca4ffb092edde6a50
SSDEEP

768:0Qz7yVEhs9+syJP6ntOOtEvwDpjFSXOQ69zbjlAAX5e9zz:0j+soPSMOtEvwDpjwizbR9Xwzz

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/3012-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c00000001228a-11.dat	CryptoLocker_rule2
behavioral1/memory/3012-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2244-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2244-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/3012-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000c00000001228a-11.dat	CryptoLocker_set1
behavioral1/memory/3012-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2244-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2244-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral1/memory/3012-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/files/0x000c00000001228a-11.dat	UPX
behavioral1/memory/3012-15-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2244-16-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2244-26-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2244	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
3012	2024-06-06_91cf5b2c40f9b82584bda0b57bb5d83d_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3012-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x000c00000001228a-11.dat	upx
behavioral1/memory/3012-15-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2244-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2244-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2244	3012	2024-06-06_91cf5b2c40f9b82584bda0b57bb5d83d_cryptolocker.exe	28
PID 3012 wrote to memory of 2244	3012	2024-06-06_91cf5b2c40f9b82584bda0b57bb5d83d_cryptolocker.exe	28
PID 3012 wrote to memory of 2244	3012	2024-06-06_91cf5b2c40f9b82584bda0b57bb5d83d_cryptolocker.exe	28
PID 3012 wrote to memory of 2244	3012	2024-06-06_91cf5b2c40f9b82584bda0b57bb5d83d_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-06_91cf5b2c40f9b82584bda0b57bb5d83d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-06_91cf5b2c40f9b82584bda0b57bb5d83d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
63KB

MD5
4281cc194c3e3b0adebdb63dda4dfba1

SHA1
42238773bc3ac76d0bd59f4504a5b825d714c944

SHA256
283c7993ca3bd5dbd96bd04db88d88c85b3affaa41b3f52d5871537c917fcef8

SHA512
a759b11420f4271d63622df233b953b06dc868506721ed9bb1d1e9566952e9b063cf4900f7af172804d26c2dc147638dc472d7ba1be3116479b890b468d34a50

Download Submit
memory/2244-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2244-19-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2244-18-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2244-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3012-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3012-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3012-2-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3012-3-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/3012-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download