731ca2606aa659e30f11d0838f880fafea75627d1b1bf4f2eb1987b84e035957

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
01/08/2023, 15:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2ac5a98da0fa9a5ad060b48001a8236b_cryptolocker_JC.exe
Size

73KB
MD5

2ac5a98da0fa9a5ad060b48001a8236b
SHA1

0bd87b63b6727fc321548f7823e1cf4ef20c14b6
SHA256

731ca2606aa659e30f11d0838f880fafea75627d1b1bf4f2eb1987b84e035957
SHA512

43265fc2f8279cebffad134dff19169e357f504ad2879bcd8beaa8dc1e3f55985df36204d62bd5308e133574189352cf7941d7bf4336c411f0bda2da2e36f637
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJNpsAnJYqdIR+3:ZVxkGOtEvwDpjcNl

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2328	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1896	2ac5a98da0fa9a5ad060b48001a8236b_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2328	1896	2ac5a98da0fa9a5ad060b48001a8236b_cryptolocker_JC.exe	28
PID 1896 wrote to memory of 2328	1896	2ac5a98da0fa9a5ad060b48001a8236b_cryptolocker_JC.exe	28
PID 1896 wrote to memory of 2328	1896	2ac5a98da0fa9a5ad060b48001a8236b_cryptolocker_JC.exe	28
PID 1896 wrote to memory of 2328	1896	2ac5a98da0fa9a5ad060b48001a8236b_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\2ac5a98da0fa9a5ad060b48001a8236b_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2ac5a98da0fa9a5ad060b48001a8236b_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
73KB

MD5
6830f28227c5a4f8c1e4079f8a3d2a7b

SHA1
c31d11150ae326f78bd7a95c60d28fc73f23a7cb

SHA256
f4780cff7abbaccc264e92f87982d03f34654d7a8e4df8c1b8f4f6ddf21f08a1

SHA512
5b5dbdc0d716246c2e4b2bec4e71b68c1aaf3062f824a58ae52ea412478394120631289474ebea17b741c4259f3e90efcde73e1dcac6eed679efd389226ecf7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
73KB

MD5
6830f28227c5a4f8c1e4079f8a3d2a7b

SHA1
c31d11150ae326f78bd7a95c60d28fc73f23a7cb

SHA256
f4780cff7abbaccc264e92f87982d03f34654d7a8e4df8c1b8f4f6ddf21f08a1

SHA512
5b5dbdc0d716246c2e4b2bec4e71b68c1aaf3062f824a58ae52ea412478394120631289474ebea17b741c4259f3e90efcde73e1dcac6eed679efd389226ecf7a

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
73KB

MD5
6830f28227c5a4f8c1e4079f8a3d2a7b

SHA1
c31d11150ae326f78bd7a95c60d28fc73f23a7cb

SHA256
f4780cff7abbaccc264e92f87982d03f34654d7a8e4df8c1b8f4f6ddf21f08a1

SHA512
5b5dbdc0d716246c2e4b2bec4e71b68c1aaf3062f824a58ae52ea412478394120631289474ebea17b741c4259f3e90efcde73e1dcac6eed679efd389226ecf7a

Download Submit
memory/1896-55-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/1896-54-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1896-57-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/1896-56-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2328-69-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download
memory/2328-71-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2328-72-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2328-79-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download