aa8cc489e9e8fa978969251f8d08085860e5cde5312b8db9f906b9dac3d5d3fd

Analysis

max time kernel
130s
max time network
142s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
05/08/2023, 13:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7453c120b2a2d107780b99abbf5fb687_cryptolocker_JC.exe
Size

73KB
MD5

7453c120b2a2d107780b99abbf5fb687
SHA1

3cb50a18d1fe3ac5175f1cd660b4885e63fe99ea
SHA256

aa8cc489e9e8fa978969251f8d08085860e5cde5312b8db9f906b9dac3d5d3fd
SHA512

b3cf85dfad99ecc28f45a42920368befe1e241fb6a0293d319c73010796349cafdd0667ccdf0a6c8ced337b335bd955a938e999a298c682381e303e8dffa2612
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJNpsAnJYqdIR+Gw:ZVxkGOtEvwDpjcNR

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3012	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1616	7453c120b2a2d107780b99abbf5fb687_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 3012	1616	7453c120b2a2d107780b99abbf5fb687_cryptolocker_JC.exe	28
PID 1616 wrote to memory of 3012	1616	7453c120b2a2d107780b99abbf5fb687_cryptolocker_JC.exe	28
PID 1616 wrote to memory of 3012	1616	7453c120b2a2d107780b99abbf5fb687_cryptolocker_JC.exe	28
PID 1616 wrote to memory of 3012	1616	7453c120b2a2d107780b99abbf5fb687_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\7453c120b2a2d107780b99abbf5fb687_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\7453c120b2a2d107780b99abbf5fb687_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
73KB

MD5
f25f1b3b4220776088ee963061c690ae

SHA1
cfe052eb73afcaf96ff6f0a593baa9fad2e75643

SHA256
7c047554bf4f85b910265ae27b3d58d3eae68d501ebcc7223d47a8ef45848b6e

SHA512
573d0e7679fadf3c33f7712d8661dbcfec13fedc1f7dd64148d1b810421632d7e4ef0f8537ab93e5f8c07cc7775ac5ef72f4e26083017635b3f8477d4448e2d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
73KB

MD5
f25f1b3b4220776088ee963061c690ae

SHA1
cfe052eb73afcaf96ff6f0a593baa9fad2e75643

SHA256
7c047554bf4f85b910265ae27b3d58d3eae68d501ebcc7223d47a8ef45848b6e

SHA512
573d0e7679fadf3c33f7712d8661dbcfec13fedc1f7dd64148d1b810421632d7e4ef0f8537ab93e5f8c07cc7775ac5ef72f4e26083017635b3f8477d4448e2d4

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
73KB

MD5
f25f1b3b4220776088ee963061c690ae

SHA1
cfe052eb73afcaf96ff6f0a593baa9fad2e75643

SHA256
7c047554bf4f85b910265ae27b3d58d3eae68d501ebcc7223d47a8ef45848b6e

SHA512
573d0e7679fadf3c33f7712d8661dbcfec13fedc1f7dd64148d1b810421632d7e4ef0f8537ab93e5f8c07cc7775ac5ef72f4e26083017635b3f8477d4448e2d4

Download Submit
memory/1616-55-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/1616-54-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1616-57-0x0000000000230000-0x00000000002B0000-memory.dmp

Filesize
512KB

Download
memory/1616-59-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3012-69-0x00000000002C0000-0x00000000002C3000-memory.dmp

Filesize
12KB

Download
memory/3012-72-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/3012-79-0x00000000002C0000-0x00000000002C3000-memory.dmp

Filesize
12KB

Download