7ff6157e8e290b4aa1154d8ec4162e2999e2d9ae0d456fa368ea6d4193ef05eb

Analysis

max time kernel
153s
max time network
185s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2022-12-05_9d1ccb567f0c4663724704707f521bae_cryptolocker.exe
Size

111KB
MD5

9d1ccb567f0c4663724704707f521bae
SHA1

42062b36d04d020ef2f5bc8f6946b3a600b5f340
SHA256

7ff6157e8e290b4aa1154d8ec4162e2999e2d9ae0d456fa368ea6d4193ef05eb
SHA512

e4a5f9e4b75f4361b9d5a93e2876c0ccdc8a4d6d461f028520f8dc9951d1ea8bf303905250b7d61705790f0ff2a5497194f87f8869c43238604d55a46d5cba50
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfIuBK6:vCjsIOtEvwDpj5H9YvQd2D

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1532	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1004	2022-12-05_9d1ccb567f0c4663724704707f521bae_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 1532	1004	2022-12-05_9d1ccb567f0c4663724704707f521bae_cryptolocker.exe	28
PID 1004 wrote to memory of 1532	1004	2022-12-05_9d1ccb567f0c4663724704707f521bae_cryptolocker.exe	28
PID 1004 wrote to memory of 1532	1004	2022-12-05_9d1ccb567f0c4663724704707f521bae_cryptolocker.exe	28
PID 1004 wrote to memory of 1532	1004	2022-12-05_9d1ccb567f0c4663724704707f521bae_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2022-12-05_9d1ccb567f0c4663724704707f521bae_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2022-12-05_9d1ccb567f0c4663724704707f521bae_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
111KB

MD5
492180150cf314e669e443defafdef16

SHA1
2de8b8b725a934011a060ba12cc614218d0f88fa

SHA256
e42009c8a12bdabaf62cde6124af740232e3580ebe3b3a621302f36ca8fe2c68

SHA512
2556131b5f2a4b06c540764c9f7133e2bbd279993c733e37d0ce9b2f929603753513780acf0d18a7f14b4f1339a5f82387f3bbc0e42bdd938701710a38cf2d1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
111KB

MD5
492180150cf314e669e443defafdef16

SHA1
2de8b8b725a934011a060ba12cc614218d0f88fa

SHA256
e42009c8a12bdabaf62cde6124af740232e3580ebe3b3a621302f36ca8fe2c68

SHA512
2556131b5f2a4b06c540764c9f7133e2bbd279993c733e37d0ce9b2f929603753513780acf0d18a7f14b4f1339a5f82387f3bbc0e42bdd938701710a38cf2d1b

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
111KB

MD5
492180150cf314e669e443defafdef16

SHA1
2de8b8b725a934011a060ba12cc614218d0f88fa

SHA256
e42009c8a12bdabaf62cde6124af740232e3580ebe3b3a621302f36ca8fe2c68

SHA512
2556131b5f2a4b06c540764c9f7133e2bbd279993c733e37d0ce9b2f929603753513780acf0d18a7f14b4f1339a5f82387f3bbc0e42bdd938701710a38cf2d1b

Download Submit
memory/1004-54-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1004-55-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/1004-56-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/1004-62-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1532-68-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/1532-75-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download