f2c170b062f67bd4f11cd82e48a787c760fbd661012de5cce6dc85ad8cc14ec6

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
05/08/2023, 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

718538165ac24648d871046b5703743a_cryptolocker_JC.exe
Size

70KB
MD5

718538165ac24648d871046b5703743a
SHA1

b120e97cdc1b2d1b0dcdbe65f348f35e9c18bc52
SHA256

f2c170b062f67bd4f11cd82e48a787c760fbd661012de5cce6dc85ad8cc14ec6
SHA512

7ad129b380da003eb36ed40ddcac4b9d209b32c0a06637727a4b4a1955b8c74917f5314e610fe48e54b6e26a4eb2398366a54ecdf3a5a5dd7040850de538e7bc
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MzInb9VG4k:xj+VGMOtEvwDpjubwQE1dk

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1436	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1996	718538165ac24648d871046b5703743a_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1436	1996	718538165ac24648d871046b5703743a_cryptolocker_JC.exe	30
PID 1996 wrote to memory of 1436	1996	718538165ac24648d871046b5703743a_cryptolocker_JC.exe	30
PID 1996 wrote to memory of 1436	1996	718538165ac24648d871046b5703743a_cryptolocker_JC.exe	30
PID 1996 wrote to memory of 1436	1996	718538165ac24648d871046b5703743a_cryptolocker_JC.exe	30

C:\Users\Admin\AppData\Local\Temp\718538165ac24648d871046b5703743a_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\718538165ac24648d871046b5703743a_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
70KB

MD5
33d571c1a012d5fe3374826a05e7e37e

SHA1
8e807ebf6c86b6b6e74fb6f2a592caa38a781654

SHA256
2acb52c5b22480dcf40e3120437f40111ef7a4998a9714bb4e28c50a9c7d3f23

SHA512
d9bee3357da3805139aa1726a1528cedf40acef926e20542b6f9fe283c6c64d68d50ec81098abd4035018a9db2c882e5c8926b27ba89d7298ecb0846d5bdf0af

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
70KB

MD5
33d571c1a012d5fe3374826a05e7e37e

SHA1
8e807ebf6c86b6b6e74fb6f2a592caa38a781654

SHA256
2acb52c5b22480dcf40e3120437f40111ef7a4998a9714bb4e28c50a9c7d3f23

SHA512
d9bee3357da3805139aa1726a1528cedf40acef926e20542b6f9fe283c6c64d68d50ec81098abd4035018a9db2c882e5c8926b27ba89d7298ecb0846d5bdf0af

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
70KB

MD5
33d571c1a012d5fe3374826a05e7e37e

SHA1
8e807ebf6c86b6b6e74fb6f2a592caa38a781654

SHA256
2acb52c5b22480dcf40e3120437f40111ef7a4998a9714bb4e28c50a9c7d3f23

SHA512
d9bee3357da3805139aa1726a1528cedf40acef926e20542b6f9fe283c6c64d68d50ec81098abd4035018a9db2c882e5c8926b27ba89d7298ecb0846d5bdf0af

Download Submit
memory/1436-73-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/1436-70-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1436-72-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/1436-80-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1996-55-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/1996-56-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/1996-68-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1996-65-0x0000000001F60000-0x0000000001F70000-memory.dmp

Filesize
64KB

Download
memory/1996-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1996-54-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download