7c09667f70638b76873d48cd5d8e689e81778b7a8b5601d0431501dfa81e286f

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 19:43

Target

2024-05-21_ea6b2510d012009c749895320a84091a_cryptolocker.exe
Size

80KB
MD5

ea6b2510d012009c749895320a84091a
SHA1

2b508e7c81a1ebcd4bcf9de9fa5b9fd0f65fdd81
SHA256

7c09667f70638b76873d48cd5d8e689e81778b7a8b5601d0431501dfa81e286f
SHA512

f25f48c710595299e398e026c7bfb234ac0cb6e3ce8170a944a56d45d33b775ec0c8ca612e49d06a1acad383710147777a64ab4b7291dfdc60295b0f9cdc5475
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ3KEWT+v:ZVxkGOtEvwDpjcaxF

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2176 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-21_ea6b2510d012009c749895320a84091a_cryptolocker.exe

pid process

2408 2024-05-21_ea6b2510d012009c749895320a84091a_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2176	misid.exe

pid	process
2408	2024-05-21_ea6b2510d012009c749895320a84091a_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-21_ea6b2510d012009c749895320a84091a_cryptolocker.exe

description	pid	process	target process
PID 2408 wrote to memory of 2176	2408	2024-05-21_ea6b2510d012009c749895320a84091a_cryptolocker.exe	misid.exe
PID 2408 wrote to memory of 2176	2408	2024-05-21_ea6b2510d012009c749895320a84091a_cryptolocker.exe	misid.exe
PID 2408 wrote to memory of 2176	2408	2024-05-21_ea6b2510d012009c749895320a84091a_cryptolocker.exe	misid.exe
PID 2408 wrote to memory of 2176	2408	2024-05-21_ea6b2510d012009c749895320a84091a_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_ea6b2510d012009c749895320a84091a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_ea6b2510d012009c749895320a84091a_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2176

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
80KB

MD5
3b9046925eacc66c0c69d73383f3a106

SHA1
01b8f3b876a248d82f506ef38f174cea88cd2b0b

SHA256
5aaead36d4bc1aca7e912ff9b6d0876a379b8a63b36a833b22a931b86006ede7

SHA512
b3dd080edeb2b2c18971045901b7a0edfc7305a96d12d9862c286a252097754d0b2bd1caa6e6aee629865fdc6f7c27ea73d301cb105d239ea831ac1641bd4f33

Download Submit
memory/2176-17-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2176-24-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2408-1-0x0000000000230000-0x0000000000270000-memory.dmp

Filesize
256KB

Download
memory/2408-0-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2408-9-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2408-2-0x00000000004C0000-0x00000000004C6000-memory.dmp

Filesize
24KB

Download
memory/2408-15-0x0000000000230000-0x0000000000270000-memory.dmp

Filesize
256KB

Download