92a90247e674f09165d4b86607e06759091bc7bd1ff9811eb881d36e66c372ea

Analysis

max time kernel
133s
max time network
148s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2022-11-23_f84668cc7224f6771610c2fbc60cc65a_cryptolocker.exe
Size

33KB
MD5

f84668cc7224f6771610c2fbc60cc65a
SHA1

90a4767e5ab80ec3243c88e03cf9333a832e2d3d
SHA256

92a90247e674f09165d4b86607e06759091bc7bd1ff9811eb881d36e66c372ea
SHA512

624c8bb52818390098c10091ba4c7bcb450fdd40f62c92d590cb4157df8129e7dc5687daa22620bee9cc27c1f833618b793023981f97a7c03df6ad6abf23e94b
SSDEEP

384:v0VkMq01bJ3wtEwPS8HLEh+Jagz+3be+26Rsn1rCcOQtOOtEvwDpjqIGRGyo9sNL:vQz7yVEhs9+js1SQtOOtEvwDpjfcXx

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2024 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2022-11-23_f84668cc7224f6771610c2fbc60cc65a_cryptolocker.exe

pid process

1488 2022-11-23_f84668cc7224f6771610c2fbc60cc65a_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2024	misid.exe

pid	process
1488	2022-11-23_f84668cc7224f6771610c2fbc60cc65a_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2022-11-23_f84668cc7224f6771610c2fbc60cc65a_cryptolocker.exe

description	pid	process	target process
PID 1488 wrote to memory of 2024	1488	2022-11-23_f84668cc7224f6771610c2fbc60cc65a_cryptolocker.exe	misid.exe
PID 1488 wrote to memory of 2024	1488	2022-11-23_f84668cc7224f6771610c2fbc60cc65a_cryptolocker.exe	misid.exe
PID 1488 wrote to memory of 2024	1488	2022-11-23_f84668cc7224f6771610c2fbc60cc65a_cryptolocker.exe	misid.exe
PID 1488 wrote to memory of 2024	1488	2022-11-23_f84668cc7224f6771610c2fbc60cc65a_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2022-11-23_f84668cc7224f6771610c2fbc60cc65a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2022-11-23_f84668cc7224f6771610c2fbc60cc65a_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1488

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2024

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
33KB

MD5
94e8921a241b5086e6076c51e0b3ef97

SHA1
1b92b1cf5815342fbedd700599eec73599821644

SHA256
2119993869078353050a08d1142dfd2fef2e5c93bf474ea1a12882c59e23c4fb

SHA512
e09fa36628a00b4368000f867622cf143919f8c421592150cd556b5825992944ea44a4c185b8b63baf291c98fce76fcd216b6875634fb4e5d6ff73d92554745a

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
33KB

MD5
94e8921a241b5086e6076c51e0b3ef97

SHA1
1b92b1cf5815342fbedd700599eec73599821644

SHA256
2119993869078353050a08d1142dfd2fef2e5c93bf474ea1a12882c59e23c4fb

SHA512
e09fa36628a00b4368000f867622cf143919f8c421592150cd556b5825992944ea44a4c185b8b63baf291c98fce76fcd216b6875634fb4e5d6ff73d92554745a

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
33KB

MD5
94e8921a241b5086e6076c51e0b3ef97

SHA1
1b92b1cf5815342fbedd700599eec73599821644

SHA256
2119993869078353050a08d1142dfd2fef2e5c93bf474ea1a12882c59e23c4fb

SHA512
e09fa36628a00b4368000f867622cf143919f8c421592150cd556b5825992944ea44a4c185b8b63baf291c98fce76fcd216b6875634fb4e5d6ff73d92554745a

Download Submit
memory/1488-54-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/1488-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1488-56-0x0000000000260000-0x0000000000266000-memory.dmp

Filesize
24KB

Download
memory/1488-62-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2024-64-0x0000000000000000-mapping.dmp

Download
memory/2024-68-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2024-75-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download