50bfec0ee16e527276992334ce0c968583b6ecefbcaabd12f604d7d260472580

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
04-08-2023 18:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

685ed60d6eef9c73602bea535fd117a1_cryptolocker_JC.exe
Size

111KB
MD5

685ed60d6eef9c73602bea535fd117a1
SHA1

137fa79b0d1d5d83d8bd3faca55e14ca82f159d6
SHA256

50bfec0ee16e527276992334ce0c968583b6ecefbcaabd12f604d7d260472580
SHA512

17c61a616e2e74ffbfb0a72f377480bb18b53cfd42d004be19342eeddee82271b4f98b8c45089b9e60c6c36dbf931e52eea6793eb6f20a545084d6ab81cdbe75
SSDEEP

768:gUQz7yVEhs9+4T/1bytOOtEvwDpjNbZ7uyA36S7MpxRIIXVe3mU9j:gUj+AIMOtEvwDpjNbwQEIPlemUx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2656	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2060	685ed60d6eef9c73602bea535fd117a1_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2656	2060	685ed60d6eef9c73602bea535fd117a1_cryptolocker_JC.exe	28
PID 2060 wrote to memory of 2656	2060	685ed60d6eef9c73602bea535fd117a1_cryptolocker_JC.exe	28
PID 2060 wrote to memory of 2656	2060	685ed60d6eef9c73602bea535fd117a1_cryptolocker_JC.exe	28
PID 2060 wrote to memory of 2656	2060	685ed60d6eef9c73602bea535fd117a1_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\685ed60d6eef9c73602bea535fd117a1_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\685ed60d6eef9c73602bea535fd117a1_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
111KB

MD5
82cc6453103790f488d5afc916caf666

SHA1
737ea693601bec3f71cad8d34d9cac0e5c09e9b1

SHA256
bc8b6f78b299288d00f04cb4a8128dacf7437c050325f0e295b30fe2c3cbeb3e

SHA512
adc5f52780ad8beb77656a141f56c1d143c382a2d912154a9c08170b774d6c67c0767c17ea1300e7300184018fe1a9d93098227a409d5e30e1b9c1c89da6dd58

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
111KB

MD5
82cc6453103790f488d5afc916caf666

SHA1
737ea693601bec3f71cad8d34d9cac0e5c09e9b1

SHA256
bc8b6f78b299288d00f04cb4a8128dacf7437c050325f0e295b30fe2c3cbeb3e

SHA512
adc5f52780ad8beb77656a141f56c1d143c382a2d912154a9c08170b774d6c67c0767c17ea1300e7300184018fe1a9d93098227a409d5e30e1b9c1c89da6dd58

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
111KB

MD5
82cc6453103790f488d5afc916caf666

SHA1
737ea693601bec3f71cad8d34d9cac0e5c09e9b1

SHA256
bc8b6f78b299288d00f04cb4a8128dacf7437c050325f0e295b30fe2c3cbeb3e

SHA512
adc5f52780ad8beb77656a141f56c1d143c382a2d912154a9c08170b774d6c67c0767c17ea1300e7300184018fe1a9d93098227a409d5e30e1b9c1c89da6dd58

Download Submit
memory/2060-54-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2060-56-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2060-55-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2656-70-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2656-69-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download