a7a16eb1df65e1ffb5a409de289fad181f35b4880378375d9e53b08a435730a2

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-11_45e593394874085a748bbc190d0207dd_cryptolocker.exe
Size

45KB
MD5

45e593394874085a748bbc190d0207dd
SHA1

a4bc67089c207a2e938bcc147dc670a612a46389
SHA256

a7a16eb1df65e1ffb5a409de289fad181f35b4880378375d9e53b08a435730a2
SHA512

6e65f49240abbd7ba9786b0df2fa5f1a63027f3d40eb7d7ffaf1fb1b3430a52a6ae6dc00295931bbe43c07ed7f2ca83560b5d1c8e34842018d475f547f26b3ec
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/aMDZ:6j+1NMOtEvwDpjrRrl

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2328-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000a00000001431c-11.dat	CryptoLocker_rule2
behavioral1/memory/1964-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2328-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1964-26-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/2328-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000a00000001431c-11.dat	CryptoLocker_set1
behavioral1/memory/1964-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2328-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1964-26-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral1/memory/2328-0-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x000a00000001431c-11.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1964-16-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2328-15-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1964-26-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

pid	Process
1964	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2328	2024-06-11_45e593394874085a748bbc190d0207dd_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 1964	2328	2024-06-11_45e593394874085a748bbc190d0207dd_cryptolocker.exe	28
PID 2328 wrote to memory of 1964	2328	2024-06-11_45e593394874085a748bbc190d0207dd_cryptolocker.exe	28
PID 2328 wrote to memory of 1964	2328	2024-06-11_45e593394874085a748bbc190d0207dd_cryptolocker.exe	28
PID 2328 wrote to memory of 1964	2328	2024-06-11_45e593394874085a748bbc190d0207dd_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-11_45e593394874085a748bbc190d0207dd_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-11_45e593394874085a748bbc190d0207dd_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
46KB

MD5
635a2ffd428cfa22c02c8dfb2c465e60

SHA1
2cdd08f498c902bb33a137ba1276f080fd9c90a0

SHA256
260f04bf399250d56948b945a511f6a0712e2bfc769fe642a0d0cca486a422fc

SHA512
b8b78ac9014db7d36945cd0a2b0a68fa21299f6f9d9a4291287ee9ba15b34d78401aaa97e804519f87e0beedc5cc89b911618ef8769bcaa5183f5636c4689803

Download Submit
memory/1964-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1964-18-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/1964-25-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1964-26-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2328-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2328-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2328-2-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2328-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2328-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download