MALICIOUS — {71257279-042b-371d-a1d3-fbf8d2fadffa}.exe

MALICIOUS — {71257279-042b-371d-a1d3-fbf8d2fadffa}.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Cryptolocker family. 7 of 51 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

• SHA-256: d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9
• SHA-1: 65559245709fe98052eb284577f1fd61c01ad20d
• MD5: 04fb36199787f2e3e2135611a38321eb
• imphash: 7b2874f35ad4f5e3195b36374c78106f
• ssdeep: 6144:sWmw0EuCN0pLWgTO3x5N22vWvLRKKAX5l++SybIvC:sWkEuCaNT85I2vCMX5l+ZRv
• TLSH: T1FF47D04E791A6B0ED2F2A3141EF8895D0CE4749912B1A58C0F83D56A79D2C374FB90BC
• Submitted as: {71257279-042b-371d-a1d3-fbf8d2fadffa}.exe
• File type: pe · Size: 346112 bytes
• Verdict: malicious (100/100) · Family: Cryptolocker

Detections (7 of 51 engines)

• capa (capabilities): capability:collection/keylog
• MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
• ClamAV (daily): Win.Trojan.Cryptolocker-2
• Cyble Vision: Cyble Vision: CryptoLocker
• Detect It Easy (packer/type): DIE:Microsoft Linker
• Microsoft Defender: Ransom:Win32/Crilock.A
• Emsisoft (Emergency Kit): Trojan.Agent.BBPC

MITRE ATT&CK

• T1547.001
• T1071.001
• T1486
• T1056.001
• T1543.003
• T1112
• T1105

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Cryptolocker-2 (rule Win.Trojan.Cryptolocker-2) - engine signal, weight 0.90, confidence 0.95
• Cyble Vision flagged Cyble Vision: CryptoLocker (rule Cyble Vision: CryptoLocker) - engine signal, weight 0.90, confidence 0.95
• Dropped a malicious payload (Cryptolocker): d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9 - dynamic signal, weight 0.80, confidence 0.90
• Microsoft Defender flagged Ransom:Win32/Crilock.A (rule Ransom:Win32/Crilock.A) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Agent.BBPC (rule Trojan.Agent.BBPC) - engine signal, weight 0.55, confidence 0.85
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• 1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: http://en.wikipedia.org/wiki/RSA_%28algorithm%29, https://www.moneypak.com/StoreLocator.aspx, https://www.moneypak.com/ - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60
• Extracted generic config (10 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

20786 behavior events · 2 ATT&CK techniques · 1 dropped files.

Runtime network

• none

Dropped files

• /opt/CAPEv2/storage/analyses/5593/files/d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9 - d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9

Embedded URLs

• http://en.wikipedia.org/wiki/RSA_%28algorithm%29
• https://www.moneypak.com/StoreLocator.aspx
• https://www.moneypak.com/
• https://www.ukash.com/en-GB/registration/
• https://www.ukash.com/en-GB/
• https://www.ukash.com/en-GB/where-to-get/
• https://www.cashu.com/
• https://www.cashu.com/site/en/fundcashU
• http://bitcoin.org/en/
• http://bitcoin.org/en/getting-started

Embedded domains

• jc.ga
• en.wikipedia.org
• www.moneypak.com
• www.ukash.com
• www.cashu.com
• bitcoin.org
• co.uk

Embedded IP addresses

• 184.164.136.134

File paths

• X:\:`:d:h:l:v:}:
• X:\:`:

More Cryptolocker samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report