ee8cfc881a7a74719a94798ddf4e2400ee7fce62a504bdd79cddc133a8b7daaa

Analysis

max time kernel
141s
max time network
144s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
02/08/2023, 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e14f2c6e0a93c50e7f42b5851fff5be_cryptolocker_JC.exe
Size

78KB
MD5

3e14f2c6e0a93c50e7f42b5851fff5be
SHA1

9dd4f38a1ad6a0641f09e13acf3f98538f2eb6cc
SHA256

ee8cfc881a7a74719a94798ddf4e2400ee7fce62a504bdd79cddc133a8b7daaa
SHA512

a92a91f673355189e7710247798558907dea8e67bd2e889d9c572acc7382aaddee39732002b5ef00aaa04e2c6d3479507fa8790accdc154a2d002af2955e557d
SSDEEP

768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRXrZSUfFKazNc8wGrT:i5nkFGMOtEvwDpjNbwQEI8UtzNc8wU

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2844	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2572	3e14f2c6e0a93c50e7f42b5851fff5be_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 2844	2572	3e14f2c6e0a93c50e7f42b5851fff5be_cryptolocker_JC.exe	28
PID 2572 wrote to memory of 2844	2572	3e14f2c6e0a93c50e7f42b5851fff5be_cryptolocker_JC.exe	28
PID 2572 wrote to memory of 2844	2572	3e14f2c6e0a93c50e7f42b5851fff5be_cryptolocker_JC.exe	28
PID 2572 wrote to memory of 2844	2572	3e14f2c6e0a93c50e7f42b5851fff5be_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\3e14f2c6e0a93c50e7f42b5851fff5be_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\3e14f2c6e0a93c50e7f42b5851fff5be_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
78KB

MD5
1bfc22f5ace77674d1889306d953a131

SHA1
f5b98594414ada2e053cbb0c087a90010f377796

SHA256
a9b6f3dd4b4c5c00f5b65c8e3f552219075bde95162d72d5923cae06605bcd34

SHA512
05f80acb33c2ba40b1f0f8ca24d670334f436262e4ace75411c0963bcd8afd388ea3466eb965d892d92b8b7c1097ee8e8b22a0bbf2409db5967740e05b788404

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
78KB

MD5
1bfc22f5ace77674d1889306d953a131

SHA1
f5b98594414ada2e053cbb0c087a90010f377796

SHA256
a9b6f3dd4b4c5c00f5b65c8e3f552219075bde95162d72d5923cae06605bcd34

SHA512
05f80acb33c2ba40b1f0f8ca24d670334f436262e4ace75411c0963bcd8afd388ea3466eb965d892d92b8b7c1097ee8e8b22a0bbf2409db5967740e05b788404

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
78KB

MD5
1bfc22f5ace77674d1889306d953a131

SHA1
f5b98594414ada2e053cbb0c087a90010f377796

SHA256
a9b6f3dd4b4c5c00f5b65c8e3f552219075bde95162d72d5923cae06605bcd34

SHA512
05f80acb33c2ba40b1f0f8ca24d670334f436262e4ace75411c0963bcd8afd388ea3466eb965d892d92b8b7c1097ee8e8b22a0bbf2409db5967740e05b788404

Download Submit
memory/2572-57-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2572-68-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2572-54-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2572-56-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2572-70-0x0000000002480000-0x000000000248F000-memory.dmp

Filesize
60KB

Download
memory/2572-55-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2572-81-0x0000000002480000-0x000000000248F000-memory.dmp

Filesize
60KB

Download
memory/2844-71-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2844-73-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2844-74-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2844-82-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download