4e868a078b15d25d54da27229e38a10b19c0be2c66072f82e7abe8f6f1e80515

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:38

Target

2024-05-22_746f9f8292c888d9793d70fab00376f0_cryptolocker.exe
Size

78KB
MD5

746f9f8292c888d9793d70fab00376f0
SHA1

c04f21a77e49fabfd8020df9480ef0e09b8871fd
SHA256

4e868a078b15d25d54da27229e38a10b19c0be2c66072f82e7abe8f6f1e80515
SHA512

0c66f4c5451d966f064cdf0c60b10bb7464471af52d8617d1fce959dacf814527701f266ef81687cacdadc9d1026c2de9738b3fe18049bcd04ea9c00b5e7cd48
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ3KUYL:ZVxkGOtEvwDpjcaA

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

3008 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_746f9f8292c888d9793d70fab00376f0_cryptolocker.exe

pid process

2224 2024-05-22_746f9f8292c888d9793d70fab00376f0_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3008	misid.exe

pid	process
2224	2024-05-22_746f9f8292c888d9793d70fab00376f0_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_746f9f8292c888d9793d70fab00376f0_cryptolocker.exe

description	pid	process	target process
PID 2224 wrote to memory of 3008	2224	2024-05-22_746f9f8292c888d9793d70fab00376f0_cryptolocker.exe	misid.exe
PID 2224 wrote to memory of 3008	2224	2024-05-22_746f9f8292c888d9793d70fab00376f0_cryptolocker.exe	misid.exe
PID 2224 wrote to memory of 3008	2224	2024-05-22_746f9f8292c888d9793d70fab00376f0_cryptolocker.exe	misid.exe
PID 2224 wrote to memory of 3008	2224	2024-05-22_746f9f8292c888d9793d70fab00376f0_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:3008

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
78KB

MD5
ad01b7c15d2d083ba06638d08b50a7b0

SHA1
92d598ada64cbfff9feda96f6bd56ac06c5f96ba

SHA256
4809b4c50b887311fad351025bc947ef06420e2f40a99a1e84db1351f80b3d66

SHA512
2bc9634906250a8709c4748e185558eb4a238b8b229657802b2d533cb05272d87e140382dbc4c6080f689bf0dc70b62c1fa0df92ea199deaef8b732b0cd2ae86

Download Submit
memory/2224-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2224-2-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2224-1-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2224-3-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/3008-15-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/3008-17-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/3008-24-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3008-25-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download