90434819ecaf5f51b42cb2f8e4d42264dd1381e04acda4f7373bfe534a32589d

Analysis

max time kernel
131s
max time network
144s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
05/08/2023, 20:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c4c176c05f1d17b8863ea6f67e2e042_cryptolocker_JC.exe
Size

35KB
MD5

7c4c176c05f1d17b8863ea6f67e2e042
SHA1

bea46d21d14792da63ff4fd78f8f30cd8a7c0591
SHA256

90434819ecaf5f51b42cb2f8e4d42264dd1381e04acda4f7373bfe534a32589d
SHA512

dcb03ff7a1cabb0291db6a57bc80f991221e7842799fce1e74d23b95a17bb810ea24f2f00969a6763e6f75c0ba36c5510d8fac1e888f4824c052c18c1f0338e6
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4REL+a:vj+jsMQMOtEvwDpj5HM

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2184	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1924	7c4c176c05f1d17b8863ea6f67e2e042_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2184	1924	7c4c176c05f1d17b8863ea6f67e2e042_cryptolocker_JC.exe	28
PID 1924 wrote to memory of 2184	1924	7c4c176c05f1d17b8863ea6f67e2e042_cryptolocker_JC.exe	28
PID 1924 wrote to memory of 2184	1924	7c4c176c05f1d17b8863ea6f67e2e042_cryptolocker_JC.exe	28
PID 1924 wrote to memory of 2184	1924	7c4c176c05f1d17b8863ea6f67e2e042_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\7c4c176c05f1d17b8863ea6f67e2e042_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\7c4c176c05f1d17b8863ea6f67e2e042_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
35KB

MD5
a4e9ff81a7a856d32712902be2a75ff1

SHA1
221a5ec7c30081285f699df5ff1853a657d232a0

SHA256
d9b23b4e09d7cb3cac83fd0a183a5263ceb5ed1983b4567cba736c46950d9bac

SHA512
07579b82a02949ce01674ba983641f6257d70cd5b213ba3e4c3588a54e694038444ca3fcc4ef10687f8e75b7b365c40fc360a7396fdd2883da9e9d1c227039ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
35KB

MD5
a4e9ff81a7a856d32712902be2a75ff1

SHA1
221a5ec7c30081285f699df5ff1853a657d232a0

SHA256
d9b23b4e09d7cb3cac83fd0a183a5263ceb5ed1983b4567cba736c46950d9bac

SHA512
07579b82a02949ce01674ba983641f6257d70cd5b213ba3e4c3588a54e694038444ca3fcc4ef10687f8e75b7b365c40fc360a7396fdd2883da9e9d1c227039ae

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
35KB

MD5
a4e9ff81a7a856d32712902be2a75ff1

SHA1
221a5ec7c30081285f699df5ff1853a657d232a0

SHA256
d9b23b4e09d7cb3cac83fd0a183a5263ceb5ed1983b4567cba736c46950d9bac

SHA512
07579b82a02949ce01674ba983641f6257d70cd5b213ba3e4c3588a54e694038444ca3fcc4ef10687f8e75b7b365c40fc360a7396fdd2883da9e9d1c227039ae

Download Submit
memory/1924-54-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1924-55-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/1924-56-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2184-69-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download