b69cf313a0a009af16ad5159520bee614c62a88feaabae224ac207e253e50ee5

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
06/08/2023, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8575504d0c20bd358060cee892c95e16_cryptolocker_JC.exe
Size

53KB
MD5

8575504d0c20bd358060cee892c95e16
SHA1

66f5a2ffe3962015d090c8e6aead85d9a3f823a0
SHA256

b69cf313a0a009af16ad5159520bee614c62a88feaabae224ac207e253e50ee5
SHA512

db4f2f7a71a4a4aaa6d3716139eb3c623b258c9fa6df579d8c5bf158e25fec9508e7b633271808164085dd56edcf2ac4245af044b914e28d2020c5014b31668a
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8lB4dCOBy/cMFqeoaHV:ZzFbxmLPWQMOtEvwDpj38lD/cMAOV

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2568	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1132	8575504d0c20bd358060cee892c95e16_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 2568	1132	8575504d0c20bd358060cee892c95e16_cryptolocker_JC.exe	28
PID 1132 wrote to memory of 2568	1132	8575504d0c20bd358060cee892c95e16_cryptolocker_JC.exe	28
PID 1132 wrote to memory of 2568	1132	8575504d0c20bd358060cee892c95e16_cryptolocker_JC.exe	28
PID 1132 wrote to memory of 2568	1132	8575504d0c20bd358060cee892c95e16_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\8575504d0c20bd358060cee892c95e16_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\8575504d0c20bd358060cee892c95e16_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
54KB

MD5
c31d64c00b35555bc27ff193cef4a2fc

SHA1
44ff7c6b9d4f942fdb1a80ae4261203fdda5af7a

SHA256
ac90e7411084ac1d5127b83b3e1e96cd55b059fcf67498bfd968bf3f7bb7a896

SHA512
60cfbdcad7a10dee181f9058c8ba56180d56a139c93fb421b5db6fb396afdc3f3d31982a20b6ef6559785da8a60a1295ad4af869972504164467261195919880

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
54KB

MD5
c31d64c00b35555bc27ff193cef4a2fc

SHA1
44ff7c6b9d4f942fdb1a80ae4261203fdda5af7a

SHA256
ac90e7411084ac1d5127b83b3e1e96cd55b059fcf67498bfd968bf3f7bb7a896

SHA512
60cfbdcad7a10dee181f9058c8ba56180d56a139c93fb421b5db6fb396afdc3f3d31982a20b6ef6559785da8a60a1295ad4af869972504164467261195919880

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
54KB

MD5
c31d64c00b35555bc27ff193cef4a2fc

SHA1
44ff7c6b9d4f942fdb1a80ae4261203fdda5af7a

SHA256
ac90e7411084ac1d5127b83b3e1e96cd55b059fcf67498bfd968bf3f7bb7a896

SHA512
60cfbdcad7a10dee181f9058c8ba56180d56a139c93fb421b5db6fb396afdc3f3d31982a20b6ef6559785da8a60a1295ad4af869972504164467261195919880

Download Submit
memory/1132-54-0x00000000002B0000-0x00000000002B3000-memory.dmp

Filesize
12KB

Download
memory/1132-55-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1132-57-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1132-56-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2568-69-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2568-72-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2568-71-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2568-79-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download