1e0803b403668ace30aa044ea878b5d88265c46203e276b44bcaee01a4173cac

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 21:13

Target

2024-05-22_eb04b3737d82433c25b3db12e40b8c29_cryptolocker.exe
Size

62KB
MD5

eb04b3737d82433c25b3db12e40b8c29
SHA1

93fea478f5ecd5592f9b0542369bbc9a36e0dcac
SHA256

1e0803b403668ace30aa044ea878b5d88265c46203e276b44bcaee01a4173cac
SHA512

a696ada85773168178f3c9c63eb003e8d153b134bf288fd6e30667d9505d1f2bd3792df5939942503eec625645267485baf4bd5d3d40139ad5008533aa5301d7
SSDEEP

768:3Uz7yVEhs9+Hs1SQtOOtEvwDpjO9+4hdCY8EQMjpi/Wpi3B3URiLqCyLuAx8XG99:3P+HsMQMOtEvwDpjoHy7B3g9CWuAxWBu

Score

9^/10

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2256-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2
behavioral1/memory/2256-13-0x0000000002840000-0x000000000284B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2256-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/3044-26-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2256-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1
behavioral1/memory/2256-13-0x0000000002840000-0x000000000284B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2256-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/3044-26-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

3044 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_eb04b3737d82433c25b3db12e40b8c29_cryptolocker.exe

pid process

2256 2024-05-22_eb04b3737d82433c25b3db12e40b8c29_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3044	misid.exe

pid	process
2256	2024-05-22_eb04b3737d82433c25b3db12e40b8c29_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_eb04b3737d82433c25b3db12e40b8c29_cryptolocker.exe

description	pid	process	target process
PID 2256 wrote to memory of 3044	2256	2024-05-22_eb04b3737d82433c25b3db12e40b8c29_cryptolocker.exe	misid.exe
PID 2256 wrote to memory of 3044	2256	2024-05-22_eb04b3737d82433c25b3db12e40b8c29_cryptolocker.exe	misid.exe
PID 2256 wrote to memory of 3044	2256	2024-05-22_eb04b3737d82433c25b3db12e40b8c29_cryptolocker.exe	misid.exe
PID 2256 wrote to memory of 3044	2256	2024-05-22_eb04b3737d82433c25b3db12e40b8c29_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_eb04b3737d82433c25b3db12e40b8c29_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_eb04b3737d82433c25b3db12e40b8c29_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3044

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
62KB

MD5
5cfc140ccdabeaa4a53f9bcdf20ace48

SHA1
599a72a6abf4ad406f2deae2a5ee29c00fb80548

SHA256
439f7c79b944ce2ed35846376a77fcc88df9c4d3dac2fad2f529d7679d75928d

SHA512
360085d1bb2400c6820bb389ed0f658c3d96f3a53bd0b0e2497ef08dd3be7ac87692d63be8d3ef8e09ff9fbe1da110ad1c53de6fb43ec4fc3e395e5f007370b9

Download Submit
memory/2256-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2256-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2256-2-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2256-3-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2256-13-0x0000000002840000-0x000000000284B000-memory.dmp

Filesize
44KB

Download
memory/2256-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/3044-18-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/3044-25-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3044-26-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download