65305d37d55aadb440d59b80b0bf94f2f359cd9f60e9da68819069e2290775ed

Analysis

max time kernel
140s
max time network
150s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
03/08/2023, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4be985ea69570e94c45f4678b12f0402_cryptolocker_JC.exe
Size

65KB
MD5

4be985ea69570e94c45f4678b12f0402
SHA1

91dcb901190d269992937139b909a282d0c6002c
SHA256

65305d37d55aadb440d59b80b0bf94f2f359cd9f60e9da68819069e2290775ed
SHA512

01e7b92e0d87d4521ddf17eefed5669ef646aa58d434e00878f32caa84f3c50262a564dc35a5cbcc51839f9d949878fc3829c4971a02db3acc875088faf75001
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfb6kZq/gqASRNtFpsDyMRli6:xj+VGMOtEvwDpjub6kZq80+Jli6

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1576	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2492	4be985ea69570e94c45f4678b12f0402_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 1576	2492	4be985ea69570e94c45f4678b12f0402_cryptolocker_JC.exe	29
PID 2492 wrote to memory of 1576	2492	4be985ea69570e94c45f4678b12f0402_cryptolocker_JC.exe	29
PID 2492 wrote to memory of 1576	2492	4be985ea69570e94c45f4678b12f0402_cryptolocker_JC.exe	29
PID 2492 wrote to memory of 1576	2492	4be985ea69570e94c45f4678b12f0402_cryptolocker_JC.exe	29

C:\Users\Admin\AppData\Local\Temp\4be985ea69570e94c45f4678b12f0402_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\4be985ea69570e94c45f4678b12f0402_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
65KB

MD5
13fbebbe20c39d150e87569f1233c86f

SHA1
e65f8396386a80068e56968dbc10b751ce10fd3d

SHA256
66064677f80e9017176b0e9b6991e92e1e734368ddeef70f0466822539bdd537

SHA512
19884722bf9a6d0c6c4d6b04573fe40f683f66f1f7b4c509dce2ffec26fd0f7038d196ee7224b21aad2caac8b1252314ef7734b03dbb244859eb477f3e8baa01

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
65KB

MD5
13fbebbe20c39d150e87569f1233c86f

SHA1
e65f8396386a80068e56968dbc10b751ce10fd3d

SHA256
66064677f80e9017176b0e9b6991e92e1e734368ddeef70f0466822539bdd537

SHA512
19884722bf9a6d0c6c4d6b04573fe40f683f66f1f7b4c509dce2ffec26fd0f7038d196ee7224b21aad2caac8b1252314ef7734b03dbb244859eb477f3e8baa01

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
65KB

MD5
13fbebbe20c39d150e87569f1233c86f

SHA1
e65f8396386a80068e56968dbc10b751ce10fd3d

SHA256
66064677f80e9017176b0e9b6991e92e1e734368ddeef70f0466822539bdd537

SHA512
19884722bf9a6d0c6c4d6b04573fe40f683f66f1f7b4c509dce2ffec26fd0f7038d196ee7224b21aad2caac8b1252314ef7734b03dbb244859eb477f3e8baa01

Download Submit
memory/1576-70-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/1576-71-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/1576-78-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2492-53-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2492-54-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2492-55-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2492-62-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2492-68-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download