d9d0fc30e98448cc39be7991b9df0cd66555744214b6eab46161b77f4cb87607

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
06/08/2023, 11:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8308ac3a67aacd5c8b31c88f4f7bdf3d_cryptolocker_JC.exe
Size

71KB
MD5

8308ac3a67aacd5c8b31c88f4f7bdf3d
SHA1

b58f3ccc6a88f820bb23413fbbc1df3d213347e2
SHA256

d9d0fc30e98448cc39be7991b9df0cd66555744214b6eab46161b77f4cb87607
SHA512

8a5fbada6d44e118889158012bf0b99d44c6530f0a31965cdb4dd4adf878e03fd7d9648586886d56ee501d46060adb25584c64018152990ddb5403395126fe7c
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ3hvLb5V5yW:ZVxkGOtEvwDpjcalN

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2088	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2584	8308ac3a67aacd5c8b31c88f4f7bdf3d_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2088	2584	8308ac3a67aacd5c8b31c88f4f7bdf3d_cryptolocker_JC.exe	28
PID 2584 wrote to memory of 2088	2584	8308ac3a67aacd5c8b31c88f4f7bdf3d_cryptolocker_JC.exe	28
PID 2584 wrote to memory of 2088	2584	8308ac3a67aacd5c8b31c88f4f7bdf3d_cryptolocker_JC.exe	28
PID 2584 wrote to memory of 2088	2584	8308ac3a67aacd5c8b31c88f4f7bdf3d_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\8308ac3a67aacd5c8b31c88f4f7bdf3d_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\8308ac3a67aacd5c8b31c88f4f7bdf3d_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
71KB

MD5
be15cdf04c1231a2afbdca43ac1513e1

SHA1
7131421acfbbebc5513759717fb530600aefbba0

SHA256
7385df4f4d1cd15372e9659989445cd8354fdfa47d60dd18e12017c61c7d7adf

SHA512
004deb2d85da52cc09533190c1b6fe4f6051b09f07ecd19773b7f10530a296e749e83890a4e9ceae7d67f571f6d384d28ebff44594148453934535a14e586c14

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
71KB

MD5
be15cdf04c1231a2afbdca43ac1513e1

SHA1
7131421acfbbebc5513759717fb530600aefbba0

SHA256
7385df4f4d1cd15372e9659989445cd8354fdfa47d60dd18e12017c61c7d7adf

SHA512
004deb2d85da52cc09533190c1b6fe4f6051b09f07ecd19773b7f10530a296e749e83890a4e9ceae7d67f571f6d384d28ebff44594148453934535a14e586c14

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
71KB

MD5
be15cdf04c1231a2afbdca43ac1513e1

SHA1
7131421acfbbebc5513759717fb530600aefbba0

SHA256
7385df4f4d1cd15372e9659989445cd8354fdfa47d60dd18e12017c61c7d7adf

SHA512
004deb2d85da52cc09533190c1b6fe4f6051b09f07ecd19773b7f10530a296e749e83890a4e9ceae7d67f571f6d384d28ebff44594148453934535a14e586c14

Download Submit
memory/2088-70-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2088-69-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2584-54-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2584-55-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2584-57-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download