b7245f9e454c415a440451b884bd87a8d62821d1f9d93c631abc7562c0eaa160

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:27

Target

2024-05-22_310495fd12a30e323038c57a88465309_cryptolocker.exe
Size

78KB
MD5

310495fd12a30e323038c57a88465309
SHA1

c764869d89a43e71e946e00a0b063342d036dd91
SHA256

b7245f9e454c415a440451b884bd87a8d62821d1f9d93c631abc7562c0eaa160
SHA512

41249e11d65d0a330b3a5408101277130d13639215f5c258f2268205035c17cc5721495cbae26edc7647e1baf1b409ef05927b9441cd08e8b1b62349d22e70c9
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ3KUY7:ZVxkGOtEvwDpjcao

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2816 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_310495fd12a30e323038c57a88465309_cryptolocker.exe

pid process

2812 2024-05-22_310495fd12a30e323038c57a88465309_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2816	misid.exe

pid	process
2812	2024-05-22_310495fd12a30e323038c57a88465309_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_310495fd12a30e323038c57a88465309_cryptolocker.exe

description	pid	process	target process
PID 2812 wrote to memory of 2816	2812	2024-05-22_310495fd12a30e323038c57a88465309_cryptolocker.exe	misid.exe
PID 2812 wrote to memory of 2816	2812	2024-05-22_310495fd12a30e323038c57a88465309_cryptolocker.exe	misid.exe
PID 2812 wrote to memory of 2816	2812	2024-05-22_310495fd12a30e323038c57a88465309_cryptolocker.exe	misid.exe
PID 2812 wrote to memory of 2816	2812	2024-05-22_310495fd12a30e323038c57a88465309_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2816

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
78KB

MD5
1326b2a9786a5259de8778d74186a28b

SHA1
b85a4fdd263ce2b1be024d3f431082602a1d7d47

SHA256
2c46802124de6e25148fdf5b800d65dffa266400e5a647cbc46ac4c29b769ea0

SHA512
bf9a2987f73913eaa27caa93e747d390625ddc5e20f5b74ff3a8a78ad15b096a3ba88f1ef1652684e283bb4a682830aeca209ffe04c933d30eb2e3f0d5be979a

Download Submit
memory/2812-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2812-1-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2812-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2812-2-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2816-16-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2816-24-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2816-23-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2816-25-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download