209f40015c258b33606045081ac6d2915ca673cb58eeed443783721df8b75ddc

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
01-08-2023 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

368d42c442feba996eb1c4cf2034acb5_cryptolocker_JC.exe
Size

41KB
MD5

368d42c442feba996eb1c4cf2034acb5
SHA1

c81eb79dae0c1bae432fb28e5347751d2027080d
SHA256

209f40015c258b33606045081ac6d2915ca673cb58eeed443783721df8b75ddc
SHA512

a5f3bcb3847bd9532caa3224cb237eaa4e739f25514850729e7cd7b2e5b18543290d814489f56b5d6328b3a31cabeacc0a3bd585ac869da818eea5932c3ddac2
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrjW:vj+jsMQMOtEvwDpj5HczerK

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2404	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1492	368d42c442feba996eb1c4cf2034acb5_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 2404	1492	368d42c442feba996eb1c4cf2034acb5_cryptolocker_JC.exe	28
PID 1492 wrote to memory of 2404	1492	368d42c442feba996eb1c4cf2034acb5_cryptolocker_JC.exe	28
PID 1492 wrote to memory of 2404	1492	368d42c442feba996eb1c4cf2034acb5_cryptolocker_JC.exe	28
PID 1492 wrote to memory of 2404	1492	368d42c442feba996eb1c4cf2034acb5_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\368d42c442feba996eb1c4cf2034acb5_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\368d42c442feba996eb1c4cf2034acb5_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
42KB

MD5
d67d006b97abce83dd1483f33b9aaf60

SHA1
59ee601d217b76c51a7e0c449acecbcf34da2b4c

SHA256
79e2840d2369cd64a416041b734b073fcae3aff3cc5d4f04df11e6dcbdfc17df

SHA512
756bcb57ab7f6d0157a232e3515506eea624523b759ad35b030807d1a865ea953e864c07bede43c3aae70fa81e652f624636e52f57b8c075b6c05f33cd4db605

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
42KB

MD5
d67d006b97abce83dd1483f33b9aaf60

SHA1
59ee601d217b76c51a7e0c449acecbcf34da2b4c

SHA256
79e2840d2369cd64a416041b734b073fcae3aff3cc5d4f04df11e6dcbdfc17df

SHA512
756bcb57ab7f6d0157a232e3515506eea624523b759ad35b030807d1a865ea953e864c07bede43c3aae70fa81e652f624636e52f57b8c075b6c05f33cd4db605

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
42KB

MD5
d67d006b97abce83dd1483f33b9aaf60

SHA1
59ee601d217b76c51a7e0c449acecbcf34da2b4c

SHA256
79e2840d2369cd64a416041b734b073fcae3aff3cc5d4f04df11e6dcbdfc17df

SHA512
756bcb57ab7f6d0157a232e3515506eea624523b759ad35b030807d1a865ea953e864c07bede43c3aae70fa81e652f624636e52f57b8c075b6c05f33cd4db605

Download Submit
memory/1492-54-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1492-55-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1492-56-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2404-69-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download