0fde85d8e3e7339e06a6004864e9da84fea9ebd8d4f6c4b099c2071df543c82f

Analysis

max time kernel
151s
max time network
171s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2022-11-23_cc83d5d58c376591178e7a1395d3ea19_cryptolocker.exe
Size

76KB
MD5

cc83d5d58c376591178e7a1395d3ea19
SHA1

405ab5cd48a5aa533ccb89ea5c92231390930db8
SHA256

0fde85d8e3e7339e06a6004864e9da84fea9ebd8d4f6c4b099c2071df543c82f
SHA512

70badff81dcb632decc82d04667797a99a3d9ad8e33442c68fbd03c97821670c5305f9c96b49aad9b18c2576bd69778bc982bd45a2d9409d24fa52343cc3d52a
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRXrZSUfltelz:xj+VGMOtEvwDpjubwQEI8Uoz

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2000 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2022-11-23_cc83d5d58c376591178e7a1395d3ea19_cryptolocker.exe

pid process

1724 2022-11-23_cc83d5d58c376591178e7a1395d3ea19_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2000	misid.exe

pid	process
1724	2022-11-23_cc83d5d58c376591178e7a1395d3ea19_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2022-11-23_cc83d5d58c376591178e7a1395d3ea19_cryptolocker.exe

description	pid	process	target process
PID 1724 wrote to memory of 2000	1724	2022-11-23_cc83d5d58c376591178e7a1395d3ea19_cryptolocker.exe	misid.exe
PID 1724 wrote to memory of 2000	1724	2022-11-23_cc83d5d58c376591178e7a1395d3ea19_cryptolocker.exe	misid.exe
PID 1724 wrote to memory of 2000	1724	2022-11-23_cc83d5d58c376591178e7a1395d3ea19_cryptolocker.exe	misid.exe
PID 1724 wrote to memory of 2000	1724	2022-11-23_cc83d5d58c376591178e7a1395d3ea19_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2022-11-23_cc83d5d58c376591178e7a1395d3ea19_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2022-11-23_cc83d5d58c376591178e7a1395d3ea19_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1724

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
76KB

MD5
a9006d3f9f344a4dc2999d85ac513493

SHA1
533e4f03bf70a779b3d4e1365b7028747f39e268

SHA256
fd5e4c91c2b6066d1e444874ed15e6100c034d73ff761569daf408989329d14b

SHA512
bde84f898526e4052a4834d74df7bbb62ed1018eee19f37d599d55cc8170f2566e72c95db8efa2bcc57679f1ddab7f7d86241ec0d7b493f1020317176e68a3e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
76KB

MD5
a9006d3f9f344a4dc2999d85ac513493

SHA1
533e4f03bf70a779b3d4e1365b7028747f39e268

SHA256
fd5e4c91c2b6066d1e444874ed15e6100c034d73ff761569daf408989329d14b

SHA512
bde84f898526e4052a4834d74df7bbb62ed1018eee19f37d599d55cc8170f2566e72c95db8efa2bcc57679f1ddab7f7d86241ec0d7b493f1020317176e68a3e5

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
76KB

MD5
a9006d3f9f344a4dc2999d85ac513493

SHA1
533e4f03bf70a779b3d4e1365b7028747f39e268

SHA256
fd5e4c91c2b6066d1e444874ed15e6100c034d73ff761569daf408989329d14b

SHA512
bde84f898526e4052a4834d74df7bbb62ed1018eee19f37d599d55cc8170f2566e72c95db8efa2bcc57679f1ddab7f7d86241ec0d7b493f1020317176e68a3e5

Download Submit
memory/1724-54-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/1724-56-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/1724-55-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/1724-65-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1724-67-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2000-63-0x0000000000000000-mapping.dmp

Download
memory/2000-69-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2000-76-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2000-77-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download