1e0f1d790c4be956bff287f2d36ea14dfd5e1960bc86d476f651e00cc3c9362f

Analysis

max time kernel
130s
max time network
142s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
01/08/2023, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

321432472898040d4cfd1fab0c6a8e2a_cryptolocker_JC.exe
Size

88KB
MD5

321432472898040d4cfd1fab0c6a8e2a
SHA1

dd69de5a0e261462db4f0b6f37fbad75b1dfa669
SHA256

1e0f1d790c4be956bff287f2d36ea14dfd5e1960bc86d476f651e00cc3c9362f
SHA512

2d66a8d6a9c729cd11ea601102b3a07e0e587a526fe233f6773845463b1e23e2896eaf215e83b84f0237dfbf46e7f0b9b2876a6f00517fd1a0ef57c46d7c0f2d
SSDEEP

1536:zj+soPSMOtEvwDpj4ktBl01hJl8QAPM8Ho6cRDp5:zCsanOtEvwDpji

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2340	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2600	321432472898040d4cfd1fab0c6a8e2a_cryptolocker_JC.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2600-54-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x000a000000012029-65.dat	upx
behavioral1/memory/2600-69-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2340-72-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x000a000000012029-70.dat	upx
behavioral1/files/0x000a000000012029-80.dat	upx
behavioral1/memory/2340-82-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2340	2600	321432472898040d4cfd1fab0c6a8e2a_cryptolocker_JC.exe	28
PID 2600 wrote to memory of 2340	2600	321432472898040d4cfd1fab0c6a8e2a_cryptolocker_JC.exe	28
PID 2600 wrote to memory of 2340	2600	321432472898040d4cfd1fab0c6a8e2a_cryptolocker_JC.exe	28
PID 2600 wrote to memory of 2340	2600	321432472898040d4cfd1fab0c6a8e2a_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\321432472898040d4cfd1fab0c6a8e2a_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\321432472898040d4cfd1fab0c6a8e2a_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
88KB

MD5
10216761a2f175cc8f15ed2a7dd26086

SHA1
e630b9ecec23c0dbb59f597f66f3961facec2d5f

SHA256
c1e147b30616b23a93caea13ba47547719f78564d524ad20df2c2e64676e2d61

SHA512
5cee8f7cbf8f4a6162bac974b72c88a6a18658a36da80f9baab1a08c718683dba17585eb55fa34449391edde2d5f4d29ed2e87b46b72de80f143a6548c1b8497

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
88KB

MD5
10216761a2f175cc8f15ed2a7dd26086

SHA1
e630b9ecec23c0dbb59f597f66f3961facec2d5f

SHA256
c1e147b30616b23a93caea13ba47547719f78564d524ad20df2c2e64676e2d61

SHA512
5cee8f7cbf8f4a6162bac974b72c88a6a18658a36da80f9baab1a08c718683dba17585eb55fa34449391edde2d5f4d29ed2e87b46b72de80f143a6548c1b8497

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
88KB

MD5
10216761a2f175cc8f15ed2a7dd26086

SHA1
e630b9ecec23c0dbb59f597f66f3961facec2d5f

SHA256
c1e147b30616b23a93caea13ba47547719f78564d524ad20df2c2e64676e2d61

SHA512
5cee8f7cbf8f4a6162bac974b72c88a6a18658a36da80f9baab1a08c718683dba17585eb55fa34449391edde2d5f4d29ed2e87b46b72de80f143a6548c1b8497

Download Submit
memory/2340-74-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2340-72-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2340-73-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2340-82-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2600-58-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2600-69-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2600-68-0x0000000001EB0000-0x0000000001EC0000-memory.dmp

Filesize
64KB

Download
memory/2600-56-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2600-54-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2600-55-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2600-81-0x0000000001EB0000-0x0000000001EC0000-memory.dmp

Filesize
64KB

Download