44b1833e1007cb45efa127960513bbe0a84d27ce0e09b290b00d2d256765d8c1

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
01-08-2023 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27521824349a4e98df1bae46bbc30940_cryptolocker_JC.exe
Size

101KB
MD5

27521824349a4e98df1bae46bbc30940
SHA1

58baaf8ecc8785dd41db04a7a40ecdf174ae26bb
SHA256

44b1833e1007cb45efa127960513bbe0a84d27ce0e09b290b00d2d256765d8c1
SHA512

79d79744a62ecd7aed6992ffc7eb51af0e4a95189e07604656136395375c7a14b96c9a59183fb228c8b05a092dd65a351fadcedcaca293de15a0f73e838a234b
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWCCyDLKASkjcYS:xj+VGMOtEvwDpjubwQEIie8+ASkq

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2844	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2584	27521824349a4e98df1bae46bbc30940_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2844	2584	27521824349a4e98df1bae46bbc30940_cryptolocker_JC.exe	28
PID 2584 wrote to memory of 2844	2584	27521824349a4e98df1bae46bbc30940_cryptolocker_JC.exe	28
PID 2584 wrote to memory of 2844	2584	27521824349a4e98df1bae46bbc30940_cryptolocker_JC.exe	28
PID 2584 wrote to memory of 2844	2584	27521824349a4e98df1bae46bbc30940_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\27521824349a4e98df1bae46bbc30940_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\27521824349a4e98df1bae46bbc30940_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
101KB

MD5
31afdea3269385295b59a0ab63224c5d

SHA1
7ffd31b9f29f78e3cd61a2c6eec8eadbf869df62

SHA256
c165f173e55376c2e63d4184234df42de6ac6409398f155fb468b6a9577a078a

SHA512
c869cfb1698e52d1b46337bb69a2349cab2ccb9d08ea0eb93365ebd8ad5c997ed32b486c9a2d4752d7e48a38455f5a297e37e6ff3d90cfe9f4a2fb5713c730ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
101KB

MD5
31afdea3269385295b59a0ab63224c5d

SHA1
7ffd31b9f29f78e3cd61a2c6eec8eadbf869df62

SHA256
c165f173e55376c2e63d4184234df42de6ac6409398f155fb468b6a9577a078a

SHA512
c869cfb1698e52d1b46337bb69a2349cab2ccb9d08ea0eb93365ebd8ad5c997ed32b486c9a2d4752d7e48a38455f5a297e37e6ff3d90cfe9f4a2fb5713c730ae

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
101KB

MD5
31afdea3269385295b59a0ab63224c5d

SHA1
7ffd31b9f29f78e3cd61a2c6eec8eadbf869df62

SHA256
c165f173e55376c2e63d4184234df42de6ac6409398f155fb468b6a9577a078a

SHA512
c869cfb1698e52d1b46337bb69a2349cab2ccb9d08ea0eb93365ebd8ad5c997ed32b486c9a2d4752d7e48a38455f5a297e37e6ff3d90cfe9f4a2fb5713c730ae

Download Submit
memory/2584-54-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2584-55-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2584-56-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2584-59-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2584-68-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2844-70-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2844-72-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/2844-73-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2844-80-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download