d41ebbc003acef248cde391a2939b04728487422ebe2a2a2a1a685bd60e7e854

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:25

Target

2024-05-22_9705d125a9ae18719c9cb92ecfcc25c6_cryptolocker.exe
Size

42KB
MD5

9705d125a9ae18719c9cb92ecfcc25c6
SHA1

cc076305f3054510280e80205bc092f544a20c79
SHA256

d41ebbc003acef248cde391a2939b04728487422ebe2a2a2a1a685bd60e7e854
SHA512

42d3467338d63ca61aa1ba1afd7f22d98e7c3f310f27cc1d79d5daac9d85d4b439f3ceb106b94e7b0c440d41c0187adefd6dd3b4e1812946956c0aae29ba4e44
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLeJAsKuDb7xLp:ZzFbxmLPWQMOtEvwDpjLeJAsKcb7j

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2884 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_9705d125a9ae18719c9cb92ecfcc25c6_cryptolocker.exe

pid process

3032 2024-05-22_9705d125a9ae18719c9cb92ecfcc25c6_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2884	misid.exe

pid	process
3032	2024-05-22_9705d125a9ae18719c9cb92ecfcc25c6_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_9705d125a9ae18719c9cb92ecfcc25c6_cryptolocker.exe

description	pid	process	target process
PID 3032 wrote to memory of 2884	3032	2024-05-22_9705d125a9ae18719c9cb92ecfcc25c6_cryptolocker.exe	misid.exe
PID 3032 wrote to memory of 2884	3032	2024-05-22_9705d125a9ae18719c9cb92ecfcc25c6_cryptolocker.exe	misid.exe
PID 3032 wrote to memory of 2884	3032	2024-05-22_9705d125a9ae18719c9cb92ecfcc25c6_cryptolocker.exe	misid.exe
PID 3032 wrote to memory of 2884	3032	2024-05-22_9705d125a9ae18719c9cb92ecfcc25c6_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2884

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
42KB

MD5
1b342c0cf771c725a3ffbe118b02494f

SHA1
63c556cd9489b34d70b32547321a1de681d352fd

SHA256
0aa49e1f16e0879321d9a01dd0faa9d4d007a063f05af431fab67dcc2d307307

SHA512
ded4c66d6c8a1a796886496cae59517ceb296bdc5020a0b5b0edcd31759b474847d27c102fa0b093ce9f8de21cca8ebf8415436197cb5e9c6f9254aae1b86235

Download Submit
memory/2884-14-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2884-16-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2884-23-0x00000000003A0000-0x00000000003A6000-memory.dmp

Filesize
24KB

Download
memory/2884-24-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/3032-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3032-1-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/3032-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download