9c1917a164145e98bf7b1f3b137ca6feff647796d32f016f7ebb324b1cd132e0

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:30

Target

2024-05-22_402e4d938f6497f2a307ea750037e8e7_cryptolocker.exe
Size

40KB
MD5

402e4d938f6497f2a307ea750037e8e7
SHA1

1640b0a8d4e9bc783f2043e199b5ed6b3b4b3c78
SHA256

9c1917a164145e98bf7b1f3b137ca6feff647796d32f016f7ebb324b1cd132e0
SHA512

3c2d590f03a92d051f787f37d837f237b68d3cb72d32feabf678790c7cd109d9d37176944ead782afa8c43e1c901ceb689417239b07a0e038b41a050d58ecd25
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLeJAsKuDkB:ZzFbxmLPWQMOtEvwDpjLeJAsKce

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2364 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_402e4d938f6497f2a307ea750037e8e7_cryptolocker.exe

pid process

2176 2024-05-22_402e4d938f6497f2a307ea750037e8e7_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2364	misid.exe

pid	process
2176	2024-05-22_402e4d938f6497f2a307ea750037e8e7_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_402e4d938f6497f2a307ea750037e8e7_cryptolocker.exe

description	pid	process	target process
PID 2176 wrote to memory of 2364	2176	2024-05-22_402e4d938f6497f2a307ea750037e8e7_cryptolocker.exe	misid.exe
PID 2176 wrote to memory of 2364	2176	2024-05-22_402e4d938f6497f2a307ea750037e8e7_cryptolocker.exe	misid.exe
PID 2176 wrote to memory of 2364	2176	2024-05-22_402e4d938f6497f2a307ea750037e8e7_cryptolocker.exe	misid.exe
PID 2176 wrote to memory of 2364	2176	2024-05-22_402e4d938f6497f2a307ea750037e8e7_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2364

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
41KB

MD5
3b034197ee05992a3bb8327dc387d0c5

SHA1
288a38eaf76fc4f92b2543407366a05a6750b452

SHA256
986797d304456a65a117be754cdef12a94eb4fe51695ebe0bbf59c4fe4d00cc6

SHA512
d649cd1ada6bd64dddcd2812a49e09cab90bf3fa7bcb18c093fb35c232154465b60003543ffae4ab442a48da46d26ece2b69bf906cfa9bfc352ed82ef292a54c

Download Submit
memory/2176-0-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2176-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2176-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2176-3-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2364-24-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2364-23-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2364-16-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download