4777d01bf92c3c01ccae57c169ed143f08c3ff26eced932333282517b976ab92

Analysis

max time kernel
138s
max time network
150s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
05/08/2023, 11:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6e587fc738e3d05e062894aa15e3d1a3_cryptolocker_JC.exe
Size

44KB
MD5

6e587fc738e3d05e062894aa15e3d1a3
SHA1

1438ae2a433c6d0e13cc11ed5d4cd357dbe51afe
SHA256

4777d01bf92c3c01ccae57c169ed143f08c3ff26eced932333282517b976ab92
SHA512

ab0fb859e61bb84fcfe2908f97df0e252b57af2fef4faf827c83446f85de105282694c79d7039487073b3abefe4f00e3c98917a995aaabb845793dba11a4ac09
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrr42A7p+:vj+jsMQMOtEvwDpj5HczerLOs

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2624	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1504	6e587fc738e3d05e062894aa15e3d1a3_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 2624	1504	6e587fc738e3d05e062894aa15e3d1a3_cryptolocker_JC.exe	28
PID 1504 wrote to memory of 2624	1504	6e587fc738e3d05e062894aa15e3d1a3_cryptolocker_JC.exe	28
PID 1504 wrote to memory of 2624	1504	6e587fc738e3d05e062894aa15e3d1a3_cryptolocker_JC.exe	28
PID 1504 wrote to memory of 2624	1504	6e587fc738e3d05e062894aa15e3d1a3_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\6e587fc738e3d05e062894aa15e3d1a3_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\6e587fc738e3d05e062894aa15e3d1a3_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
44KB

MD5
d6c145dbe2b2163ce2484285efcd11e9

SHA1
ed14630202d2eacada6511541303df3dc8d05faa

SHA256
2eeeae8e85a09dc2f0a9b1f5fbdfe325a3f2d8950890b040411acb90203425e6

SHA512
1324a661453d780a8be0efd6e9467c7df3b5feaf50184d8048a53abdefeace97abb8d24a1ea85f510d56bbfd3e0aaee9e62063ed277ece0ef0a5d2389c01a282

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
44KB

MD5
d6c145dbe2b2163ce2484285efcd11e9

SHA1
ed14630202d2eacada6511541303df3dc8d05faa

SHA256
2eeeae8e85a09dc2f0a9b1f5fbdfe325a3f2d8950890b040411acb90203425e6

SHA512
1324a661453d780a8be0efd6e9467c7df3b5feaf50184d8048a53abdefeace97abb8d24a1ea85f510d56bbfd3e0aaee9e62063ed277ece0ef0a5d2389c01a282

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
44KB

MD5
d6c145dbe2b2163ce2484285efcd11e9

SHA1
ed14630202d2eacada6511541303df3dc8d05faa

SHA256
2eeeae8e85a09dc2f0a9b1f5fbdfe325a3f2d8950890b040411acb90203425e6

SHA512
1324a661453d780a8be0efd6e9467c7df3b5feaf50184d8048a53abdefeace97abb8d24a1ea85f510d56bbfd3e0aaee9e62063ed277ece0ef0a5d2389c01a282

Download Submit
memory/1504-54-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/1504-55-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/1504-57-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2624-70-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2624-69-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download