7be142ad6950e6d86740468e9d91f08cb553dcc6b2fa8cdd9261d2dfc0c609a5

Analysis

max time kernel
132s
max time network
145s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
01/08/2023, 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29158839d1a380859f3df23305c74604_cryptolocker_JC.exe
Size

101KB
MD5

29158839d1a380859f3df23305c74604
SHA1

259b55e19476c6536815ce8c1f0bc58f39b8ee99
SHA256

7be142ad6950e6d86740468e9d91f08cb553dcc6b2fa8cdd9261d2dfc0c609a5
SHA512

4789a8bfaacb97cb19b6a3568b352a9908ccab1bd67b0fe7005277baa988f312e35e7c1fb6b032143b98add3ff131927e9414d56fe3e7b9590b08e6e06501703
SSDEEP

768:gUQz7yVEhs9+4T/1bytOOtEvwDpjNbZ7uyA36S7MpxRQdLcQPu9r:gUj+AIMOtEvwDpjNbwQEIgor

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2208	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2432	29158839d1a380859f3df23305c74604_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2208	2432	29158839d1a380859f3df23305c74604_cryptolocker_JC.exe	28
PID 2432 wrote to memory of 2208	2432	29158839d1a380859f3df23305c74604_cryptolocker_JC.exe	28
PID 2432 wrote to memory of 2208	2432	29158839d1a380859f3df23305c74604_cryptolocker_JC.exe	28
PID 2432 wrote to memory of 2208	2432	29158839d1a380859f3df23305c74604_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\29158839d1a380859f3df23305c74604_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\29158839d1a380859f3df23305c74604_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
101KB

MD5
4b58a3fe5282250c137a04d9d0c14f60

SHA1
3589b903845c3bb1643793ba92a529e178265c3a

SHA256
bb29e00c15b62be7a6aa3b78c2a91ba0be36427f1567ce0524974b872ff26bac

SHA512
39579cc20e83d3d6b939275c14632268ef1ddf8d4063329ed25581cc706aeaae80893280c07d687f611a335e0a3be2047d35ff6176c4b7ac0efc6e601decd20d

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
101KB

MD5
4b58a3fe5282250c137a04d9d0c14f60

SHA1
3589b903845c3bb1643793ba92a529e178265c3a

SHA256
bb29e00c15b62be7a6aa3b78c2a91ba0be36427f1567ce0524974b872ff26bac

SHA512
39579cc20e83d3d6b939275c14632268ef1ddf8d4063329ed25581cc706aeaae80893280c07d687f611a335e0a3be2047d35ff6176c4b7ac0efc6e601decd20d

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
101KB

MD5
4b58a3fe5282250c137a04d9d0c14f60

SHA1
3589b903845c3bb1643793ba92a529e178265c3a

SHA256
bb29e00c15b62be7a6aa3b78c2a91ba0be36427f1567ce0524974b872ff26bac

SHA512
39579cc20e83d3d6b939275c14632268ef1ddf8d4063329ed25581cc706aeaae80893280c07d687f611a335e0a3be2047d35ff6176c4b7ac0efc6e601decd20d

Download Submit
memory/2208-69-0x0000000000260000-0x0000000000266000-memory.dmp

Filesize
24KB

Download
memory/2208-70-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2432-54-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2432-56-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2432-55-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download