9b0058067c3b0a1f3b1148072d346cf603e6d2e7a864a17e54293fe7084ff49d

Analysis

max time kernel
144s
max time network
147s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
03-08-2023 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5692c2075bfaf2a5ab99391821428ea6_cryptolocker_JC.exe
Size

84KB
MD5

5692c2075bfaf2a5ab99391821428ea6
SHA1

abf8151d6b491b27280b5a811d6712f20ad1080d
SHA256

9b0058067c3b0a1f3b1148072d346cf603e6d2e7a864a17e54293fe7084ff49d
SHA512

7e0d29a6bfd2c736225d0a961f61dc52bd699ff9ec0f385f0f4a5fed70280d441e78bcf602b060d836246dc8f5ce73f3a905a442cb2d5bb7f704205afd671f38
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRXrZSUfFKaMTsLV98:xj+VGMOtEvwDpjubwQEI8UtusLX8

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3068	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
3000	5692c2075bfaf2a5ab99391821428ea6_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3068	3000	5692c2075bfaf2a5ab99391821428ea6_cryptolocker_JC.exe	30
PID 3000 wrote to memory of 3068	3000	5692c2075bfaf2a5ab99391821428ea6_cryptolocker_JC.exe	30
PID 3000 wrote to memory of 3068	3000	5692c2075bfaf2a5ab99391821428ea6_cryptolocker_JC.exe	30
PID 3000 wrote to memory of 3068	3000	5692c2075bfaf2a5ab99391821428ea6_cryptolocker_JC.exe	30

C:\Users\Admin\AppData\Local\Temp\5692c2075bfaf2a5ab99391821428ea6_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\5692c2075bfaf2a5ab99391821428ea6_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
84KB

MD5
3dd2362e15f2b9c5a3f9d8a4c79d360f

SHA1
84c3b520a8fc81441c64187fabf2b8c93018ee89

SHA256
5e5c2c31d3ae41bdc2fbe61e23ca23a20934330be9770f4445c198e85bfe44a2

SHA512
db1a0f61610ff8daea8f08564fd36d7501604955e868d0540c60109b8b980140e23b36629a887b347e2291b7990bde749459a74f0b3d5ad9f181d9fa3fc3fbfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
84KB

MD5
3dd2362e15f2b9c5a3f9d8a4c79d360f

SHA1
84c3b520a8fc81441c64187fabf2b8c93018ee89

SHA256
5e5c2c31d3ae41bdc2fbe61e23ca23a20934330be9770f4445c198e85bfe44a2

SHA512
db1a0f61610ff8daea8f08564fd36d7501604955e868d0540c60109b8b980140e23b36629a887b347e2291b7990bde749459a74f0b3d5ad9f181d9fa3fc3fbfa

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
84KB

MD5
3dd2362e15f2b9c5a3f9d8a4c79d360f

SHA1
84c3b520a8fc81441c64187fabf2b8c93018ee89

SHA256
5e5c2c31d3ae41bdc2fbe61e23ca23a20934330be9770f4445c198e85bfe44a2

SHA512
db1a0f61610ff8daea8f08564fd36d7501604955e868d0540c60109b8b980140e23b36629a887b347e2291b7990bde749459a74f0b3d5ad9f181d9fa3fc3fbfa

Download Submit
memory/3000-55-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3000-54-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3000-57-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3000-56-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/3000-59-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3068-70-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3068-72-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/3068-73-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3068-80-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download