2a1dec40fb98954d4bacab5b8fd13d21d60f22aec281766ac7b646e26b49bb96

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 21:06

Target

2024-05-22_91d3be30d7324dcd2e8e9dfad09cc732_cryptolocker.exe
Size

62KB
MD5

91d3be30d7324dcd2e8e9dfad09cc732
SHA1

e868cc4bdf20657bba3e6a7c3c84066955096e67
SHA256

2a1dec40fb98954d4bacab5b8fd13d21d60f22aec281766ac7b646e26b49bb96
SHA512

9ee209cd72b2b11581560ad04f056d989d9c3124f41a98eb09a9078099849e305a6b8f7cf0d8cce2f902279c8b12c379957c0fb2dc053171247db20e80f5f0b4
SSDEEP

768:3Uz7yVEhs9+Hs1SQtOOtEvwDpjO9+4hdCY8EQMjpi/Wpi3B3URiLqCyLuAx8XG9N:3P+HsMQMOtEvwDpjoHy7B3g9CWuAxWB+

Score

9^/10

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1964-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2
behavioral1/memory/1964-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2980-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2980-26-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1964-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
C:\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1
behavioral1/memory/1964-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2980-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2980-26-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2980 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_91d3be30d7324dcd2e8e9dfad09cc732_cryptolocker.exe

pid process

1964 2024-05-22_91d3be30d7324dcd2e8e9dfad09cc732_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2980	misid.exe

pid	process
1964	2024-05-22_91d3be30d7324dcd2e8e9dfad09cc732_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_91d3be30d7324dcd2e8e9dfad09cc732_cryptolocker.exe

description	pid	process	target process
PID 1964 wrote to memory of 2980	1964	2024-05-22_91d3be30d7324dcd2e8e9dfad09cc732_cryptolocker.exe	misid.exe
PID 1964 wrote to memory of 2980	1964	2024-05-22_91d3be30d7324dcd2e8e9dfad09cc732_cryptolocker.exe	misid.exe
PID 1964 wrote to memory of 2980	1964	2024-05-22_91d3be30d7324dcd2e8e9dfad09cc732_cryptolocker.exe	misid.exe
PID 1964 wrote to memory of 2980	1964	2024-05-22_91d3be30d7324dcd2e8e9dfad09cc732_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_91d3be30d7324dcd2e8e9dfad09cc732_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_91d3be30d7324dcd2e8e9dfad09cc732_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2980

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
62KB

MD5
e6a9d5463305e4e46deb3a65ed2a3168

SHA1
b39cab313376d6c86cb7a4af868f681868190ed2

SHA256
ceb692cee7bc905b6d824faef3c63c4a221ac75c42a85fd039261d31af392445

SHA512
703d138caeb0184f3916b74cc2be80ef79ae7f4562ffc64184359171655ffae9fa16968313f01d6cb8aa4d9604c7bcf4e3d39a8d7ef88f2ca40a23adc5f5e27a

Download Submit
memory/1964-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1964-1-0x00000000003B0000-0x00000000003B6000-memory.dmp

Filesize
24KB

Download
memory/1964-3-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download
memory/1964-9-0x00000000003B0000-0x00000000003B6000-memory.dmp

Filesize
24KB

Download
memory/1964-15-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2980-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2980-18-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/2980-25-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2980-26-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download