b1dcbba8a7b00a3a5e753d86ffee4b7ca8aac6101aa3ef2819dde340d3fbcac7

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
01/08/2023, 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28d613ce9c49eb74e8450e23c13ebf4c_cryptolocker_JC.exe
Size

42KB
MD5

28d613ce9c49eb74e8450e23c13ebf4c
SHA1

d7bc4a161cb58014c2e92d550132839f684c8b1a
SHA256

b1dcbba8a7b00a3a5e753d86ffee4b7ca8aac6101aa3ef2819dde340d3fbcac7
SHA512

f66eefad532ca37201265ce980784f37e336c2aada79394c15883620d7306f7130e544b43190ed491ff4fba08bf46b100f7a655469768119e3896eb9038e5443
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrNEb:vj+jsMQMOtEvwDpj5HczerNEb

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1420	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1508	28d613ce9c49eb74e8450e23c13ebf4c_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 1420	1508	28d613ce9c49eb74e8450e23c13ebf4c_cryptolocker_JC.exe	28
PID 1508 wrote to memory of 1420	1508	28d613ce9c49eb74e8450e23c13ebf4c_cryptolocker_JC.exe	28
PID 1508 wrote to memory of 1420	1508	28d613ce9c49eb74e8450e23c13ebf4c_cryptolocker_JC.exe	28
PID 1508 wrote to memory of 1420	1508	28d613ce9c49eb74e8450e23c13ebf4c_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\28d613ce9c49eb74e8450e23c13ebf4c_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\28d613ce9c49eb74e8450e23c13ebf4c_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
42KB

MD5
f258b67f93e3e9c79fb001c3a935acd1

SHA1
5d91a1270a26b49bc7d8faf6e2dde5fb70c5d35f

SHA256
f98baafb0efe907d5a7204e23c79319636976bdd54d8c67b7681ba971bb60f4c

SHA512
e39b1a3e36e37ae9f2af6acbe2bf3ded36d10f592df4c7f6f1b1e3c1c4fa34a85de1f1d8d6e3d688d47c12c65db3942af8d5a949a436cf6060db362ebd9bef0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
42KB

MD5
f258b67f93e3e9c79fb001c3a935acd1

SHA1
5d91a1270a26b49bc7d8faf6e2dde5fb70c5d35f

SHA256
f98baafb0efe907d5a7204e23c79319636976bdd54d8c67b7681ba971bb60f4c

SHA512
e39b1a3e36e37ae9f2af6acbe2bf3ded36d10f592df4c7f6f1b1e3c1c4fa34a85de1f1d8d6e3d688d47c12c65db3942af8d5a949a436cf6060db362ebd9bef0c

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
42KB

MD5
f258b67f93e3e9c79fb001c3a935acd1

SHA1
5d91a1270a26b49bc7d8faf6e2dde5fb70c5d35f

SHA256
f98baafb0efe907d5a7204e23c79319636976bdd54d8c67b7681ba971bb60f4c

SHA512
e39b1a3e36e37ae9f2af6acbe2bf3ded36d10f592df4c7f6f1b1e3c1c4fa34a85de1f1d8d6e3d688d47c12c65db3942af8d5a949a436cf6060db362ebd9bef0c

Download Submit
memory/1508-53-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1508-55-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/1508-54-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download