79cffb7951576f4d1e92db7bac783f510533b44b1596f14c3f5bec626fe47a11

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:46

Target

2024-05-21_b7123c6ab2dd87f6319c49dc7a3c5ca3_cryptolocker.exe
Size

42KB
MD5

b7123c6ab2dd87f6319c49dc7a3c5ca3
SHA1

33753f6b597b6672b2f7cfb474cbd96cc8304fc4
SHA256

79cffb7951576f4d1e92db7bac783f510533b44b1596f14c3f5bec626fe47a11
SHA512

2e7680f0fc5b12dca58d832f37053af976285591e004f2f35f2fdc5daa25c93e54a8aeece8ac995d4518ff957a1cc572560cca33bc83013d8cd3d11dd10171bd
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLeJAsKuDb7x7N:ZzFbxmLPWQMOtEvwDpjLeJAsKcb79N

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2168 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-21_b7123c6ab2dd87f6319c49dc7a3c5ca3_cryptolocker.exe

pid process

3000 2024-05-21_b7123c6ab2dd87f6319c49dc7a3c5ca3_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2168	misid.exe

pid	process
3000	2024-05-21_b7123c6ab2dd87f6319c49dc7a3c5ca3_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-21_b7123c6ab2dd87f6319c49dc7a3c5ca3_cryptolocker.exe

description	pid	process	target process
PID 3000 wrote to memory of 2168	3000	2024-05-21_b7123c6ab2dd87f6319c49dc7a3c5ca3_cryptolocker.exe	misid.exe
PID 3000 wrote to memory of 2168	3000	2024-05-21_b7123c6ab2dd87f6319c49dc7a3c5ca3_cryptolocker.exe	misid.exe
PID 3000 wrote to memory of 2168	3000	2024-05-21_b7123c6ab2dd87f6319c49dc7a3c5ca3_cryptolocker.exe	misid.exe
PID 3000 wrote to memory of 2168	3000	2024-05-21_b7123c6ab2dd87f6319c49dc7a3c5ca3_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2168

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
42KB

MD5
0eec6eb995a78c6e996ac322189713ff

SHA1
fb7c564710b20e35806c8e6cf70b6394a6f67073

SHA256
ac9712275638c8fbbb0d492c4352178957565c8671d58060157895cd567553be

SHA512
7342121b0d2b23e28b0c77a3acb2bbdab8b0570aa6f482aba26b44d757d032b611a771e00d2cc1894e1101f007aa831352f97278131131db6f243b638328fad3

Download Submit
memory/2168-17-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2168-24-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2168-25-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/3000-0-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/3000-1-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/3000-2-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/3000-9-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/3000-14-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download