ef3b58f7ea061404844b45b1a69e9f8355f7335f5c8292848a5103705718e071

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 19:43

Target

2024-05-21_ef42efc4045359c45c393a769236d11f_cryptolocker.exe
Size

83KB
MD5

ef42efc4045359c45c393a769236d11f
SHA1

e8097f25d9489c23b7537a0ed48702a95fecf402
SHA256

ef3b58f7ea061404844b45b1a69e9f8355f7335f5c8292848a5103705718e071
SHA512

1f9db301ff15b8543f4e50c033e97b387de20591278c2a05e730639276b0e67ac753dcc5fe7c477c6d767459ba999e365cf8d887d316cfce894b74933ee7afcd
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMrpZ:TCjsIOtEvwDpj5HE/OUHnSM9

Score

9^/10

Detection of CryptoLocker Variants 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2400-8-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2
behavioral1/memory/1036-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1036-25-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2400-8-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1
behavioral1/memory/1036-15-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1036-25-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

1036 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-21_ef42efc4045359c45c393a769236d11f_cryptolocker.exe

pid process

2400 2024-05-21_ef42efc4045359c45c393a769236d11f_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1036	misid.exe

pid	process
2400	2024-05-21_ef42efc4045359c45c393a769236d11f_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-21_ef42efc4045359c45c393a769236d11f_cryptolocker.exe

description	pid	process	target process
PID 2400 wrote to memory of 1036	2400	2024-05-21_ef42efc4045359c45c393a769236d11f_cryptolocker.exe	misid.exe
PID 2400 wrote to memory of 1036	2400	2024-05-21_ef42efc4045359c45c393a769236d11f_cryptolocker.exe	misid.exe
PID 2400 wrote to memory of 1036	2400	2024-05-21_ef42efc4045359c45c393a769236d11f_cryptolocker.exe	misid.exe
PID 2400 wrote to memory of 1036	2400	2024-05-21_ef42efc4045359c45c393a769236d11f_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_ef42efc4045359c45c393a769236d11f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_ef42efc4045359c45c393a769236d11f_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1036

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
84KB

MD5
aebcd67490da3fc9cc8ef63a32d456a0

SHA1
5c42e8db75fd6b877c1910937c15083fca37696e

SHA256
ede3d32b1a67db7706133599e1713a93888574f5c8a05629839e060a45eac7f5

SHA512
d38789da212c85558e3950ab20a4713a8d9c739104062df64b8aeabe2ff7735ddc12a448f9358a0bf002c89d8a385fe975f49b42ead21b4b732539acbac8f014

Download Submit
memory/1036-15-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/1036-17-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/1036-24-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1036-25-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2400-9-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2400-8-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2400-1-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2400-0-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download