432713a870d7924cf8481f4a8af18b3b3d0627b98985ea5b923cd7b8c82d23a4

Analysis

max time kernel
143s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:26

Target

2024-05-22_b590bac45655bfe3be0e288e0388af3a_cryptolocker.exe
Size

42KB
MD5

b590bac45655bfe3be0e288e0388af3a
SHA1

230cf38fcb83c127038a14d46f9bbb2bffa6f3cd
SHA256

432713a870d7924cf8481f4a8af18b3b3d0627b98985ea5b923cd7b8c82d23a4
SHA512

ac072eada5eef792aa894904fcaafe5bbd3b5456c99a13fa82bb0a056cdcc7645bf975b00b3c4abafa586016b8cededeef1f7d2759f6570ebfdfb7e284bb7688
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLeJAsKuDb7xL5:ZzFbxmLPWQMOtEvwDpjLeJAsKcb7T

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2932 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_b590bac45655bfe3be0e288e0388af3a_cryptolocker.exe

pid process

2772 2024-05-22_b590bac45655bfe3be0e288e0388af3a_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2932	misid.exe

pid	process
2772	2024-05-22_b590bac45655bfe3be0e288e0388af3a_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_b590bac45655bfe3be0e288e0388af3a_cryptolocker.exe

description	pid	process	target process
PID 2772 wrote to memory of 2932	2772	2024-05-22_b590bac45655bfe3be0e288e0388af3a_cryptolocker.exe	misid.exe
PID 2772 wrote to memory of 2932	2772	2024-05-22_b590bac45655bfe3be0e288e0388af3a_cryptolocker.exe	misid.exe
PID 2772 wrote to memory of 2932	2772	2024-05-22_b590bac45655bfe3be0e288e0388af3a_cryptolocker.exe	misid.exe
PID 2772 wrote to memory of 2932	2772	2024-05-22_b590bac45655bfe3be0e288e0388af3a_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2932

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
42KB

MD5
9359df1bbb6fb763d2735fd86126c169

SHA1
d4aecb8e59088a43ba72fd53a600b6cb1689d1b4

SHA256
f8fdd04274bc3972e0c70329035faa689cab4140651a547be8bc55761be85035

SHA512
25985b468dd74b51ff2dd255df8fcb49e6ec68f437ceefc1da03d4b40e8ca1942468fc47c090f8fc138a8e792ed12ad1c4126b28e4d5e0a4974f2eacbe385e52

Download Submit
memory/2772-0-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2772-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2772-2-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2772-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2932-16-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download