dce37df831bf6b206f069f322e638cb3fff76f56619edd8862f8404850b5e0f9

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 03:29

Target

2024-04-25_178de3ca7dccb66e03e79fcd5429f55b_cryptolocker.exe
Size

63KB
MD5

178de3ca7dccb66e03e79fcd5429f55b
SHA1

380caf6be57e8e4413eca5e0acb92f183ecf3875
SHA256

dce37df831bf6b206f069f322e638cb3fff76f56619edd8862f8404850b5e0f9
SHA512

40dcde9c9a54caae08c9abfd71532bdf325020f30a633037a899fb08438ee2b1c186d2418be54c401a807b14fa786143aed93831b170386195e3ba407c103dae
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMTIm:TCjsIOtEvwDpj5HE/OUHnSME

Score

9^/10

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/1936-1-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000a0000000143fa-11.dat	CryptoLocker_rule2
behavioral1/memory/1936-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2456-17-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2456-26-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/1936-1-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000a0000000143fa-11.dat	CryptoLocker_set1
behavioral1/memory/1936-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2456-17-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2456-26-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2456	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1936	2024-04-25_178de3ca7dccb66e03e79fcd5429f55b_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2456	1936	2024-04-25_178de3ca7dccb66e03e79fcd5429f55b_cryptolocker.exe	28
PID 1936 wrote to memory of 2456	1936	2024-04-25_178de3ca7dccb66e03e79fcd5429f55b_cryptolocker.exe	28
PID 1936 wrote to memory of 2456	1936	2024-04-25_178de3ca7dccb66e03e79fcd5429f55b_cryptolocker.exe	28
PID 1936 wrote to memory of 2456	1936	2024-04-25_178de3ca7dccb66e03e79fcd5429f55b_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-25_178de3ca7dccb66e03e79fcd5429f55b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-25_178de3ca7dccb66e03e79fcd5429f55b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2456

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
63KB

MD5
f7a7afeb8fedb6ebf7b7f04821cd33ce

SHA1
e4701dc8b029920a087c660ebdf7d3cc0e67749b

SHA256
07fa59fd946823abfc70b8d6489ad43f57ebbb46fff041ad4611c9148e131f6d

SHA512
e6711f2c3436d4201bd9d14387717ab3461302d9717ad7d72cf5efa854344e5dcad0ccf98e01a22a5809947fa6fbb49d0b422456cc804d79c83951e0bed2db58

Download Submit
memory/1936-1-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/1936-0-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/1936-2-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download
memory/1936-9-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/1936-15-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2456-17-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2456-18-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2456-20-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2456-26-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download