829271d14fd2609f90d5ba7bae98e357222ff38f394fb9df482d10993e6b7647

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:37

Target

2024-05-22_69f6e5c36f91e1ebd6bb92620442dfa3_cryptolocker.exe
Size

77KB
MD5

69f6e5c36f91e1ebd6bb92620442dfa3
SHA1

f302fcd4ca2b82a3c8e69fbfbc0958165baabacf
SHA256

829271d14fd2609f90d5ba7bae98e357222ff38f394fb9df482d10993e6b7647
SHA512

1eee4c542bdce4bb25a220d7eccaaf1c240487f769741be2010ff77db08af13becd980ec8edc1e806a47eb6cb4118b3dd6cd35aa75bb3a7a506cb9941b545708
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ3KUYv:ZVxkGOtEvwDpjca0

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

3032 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_69f6e5c36f91e1ebd6bb92620442dfa3_cryptolocker.exe

pid process

3040 2024-05-22_69f6e5c36f91e1ebd6bb92620442dfa3_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3032	misid.exe

pid	process
3040	2024-05-22_69f6e5c36f91e1ebd6bb92620442dfa3_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_69f6e5c36f91e1ebd6bb92620442dfa3_cryptolocker.exe

description	pid	process	target process
PID 3040 wrote to memory of 3032	3040	2024-05-22_69f6e5c36f91e1ebd6bb92620442dfa3_cryptolocker.exe	misid.exe
PID 3040 wrote to memory of 3032	3040	2024-05-22_69f6e5c36f91e1ebd6bb92620442dfa3_cryptolocker.exe	misid.exe
PID 3040 wrote to memory of 3032	3040	2024-05-22_69f6e5c36f91e1ebd6bb92620442dfa3_cryptolocker.exe	misid.exe
PID 3040 wrote to memory of 3032	3040	2024-05-22_69f6e5c36f91e1ebd6bb92620442dfa3_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:3032

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
78KB

MD5
d7fe88947eea43e13606a9151f999524

SHA1
110699747c12997078811ac18f9a1f5035582a07

SHA256
f065d99158092a0c9239633dfb99507f423000eaa33db4abbe786cf350570abf

SHA512
73e06c6d630d55c5fd0d542312bade3b8c1d21d0f17aa6255993de3587780657c51e7c7ed4a58d739bb4d54a0ac946c1eb076a3025af8d339c3ca9f59b9cccb0

Download Submit
memory/3032-15-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download
memory/3032-17-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download
memory/3032-24-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/3032-25-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download
memory/3040-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/3040-1-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/3040-2-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/3040-9-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download