e4b5f3266b765958fb45ea4e6adcb90fceb08b35cceeac507017a6febe4b6fa7

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 02:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-09_751190f297517bb6a8fc538b962eaf8a_cryptolocker.exe
Size

43KB
MD5

751190f297517bb6a8fc538b962eaf8a
SHA1

92f924d874521e66a1638e1a36f4984f62f47e6d
SHA256

e4b5f3266b765958fb45ea4e6adcb90fceb08b35cceeac507017a6febe4b6fa7
SHA512

cb273d6230d28f5b5709088ac84f818ebd37ab47fa492104e8f6386d18e56e34b8a31c50a6249017b7bda838680f47e7d9e54ed8889ec512981edb2f2874e61d
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/CtXabMww:6j+1NMOtEvwDpjrR2XabMww

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/2416-8-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c000000015cce-11.dat	CryptoLocker_rule2
behavioral1/memory/1708-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1708-25-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/2416-8-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000c000000015cce-11.dat	CryptoLocker_set1
behavioral1/memory/1708-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1708-25-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 4 IoCs

resource	yara_rule
behavioral1/memory/2416-8-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x000c000000015cce-11.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1708-15-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1708-25-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

pid	Process
1708	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2416	2024-06-09_751190f297517bb6a8fc538b962eaf8a_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 1708	2416	2024-06-09_751190f297517bb6a8fc538b962eaf8a_cryptolocker.exe	28
PID 2416 wrote to memory of 1708	2416	2024-06-09_751190f297517bb6a8fc538b962eaf8a_cryptolocker.exe	28
PID 2416 wrote to memory of 1708	2416	2024-06-09_751190f297517bb6a8fc538b962eaf8a_cryptolocker.exe	28
PID 2416 wrote to memory of 1708	2416	2024-06-09_751190f297517bb6a8fc538b962eaf8a_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-09_751190f297517bb6a8fc538b962eaf8a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-09_751190f297517bb6a8fc538b962eaf8a_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
43KB

MD5
7d75676ef143ac1a0c09af4d4451ac49

SHA1
f19401a44a76c0394865288a21f62c5feffebc40

SHA256
4a07d0bca88dc0e9dbcbdbfc4edce5941e0276c6935fb9617e67aeaaeade1aaf

SHA512
c3b13b7411d6ac6d40cbb98aaa44612c7aa2ad9b95885e7a249d45946772cd9ba5072f053d94735628b6c48d691603fab450e5fecb77aec2a1731fffbc41cfaf

Download Submit
memory/1708-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1708-24-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1708-17-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1708-25-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2416-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2416-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2416-8-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2416-1-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download