a5842022346f5462ac01832c3b84e8bed1c15603ec2086dc64f79491593e8319

Analysis

max time kernel
134s
max time network
147s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
15/08/2023, 18:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ffb062f9d6c4cfe3e54b87f9366e1ec7_cryptolocker_JC.exe
Size

31KB
MD5

ffb062f9d6c4cfe3e54b87f9366e1ec7
SHA1

93be1646893514f175a553ada2716be95a0417bd
SHA256

a5842022346f5462ac01832c3b84e8bed1c15603ec2086dc64f79491593e8319
SHA512

4d77dae299cb5517e7f83ac50f49af34fab0b6d01d92d7e6aabbd3aa28fbd5429e7bd8599f876ccd5a38d052adbe619f049f3237ed3486722a481df395982371
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8lG:ZzFbxmLPWQMOtEvwDpj38lG

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2172	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2760	ffb062f9d6c4cfe3e54b87f9366e1ec7_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2172	2760	ffb062f9d6c4cfe3e54b87f9366e1ec7_cryptolocker_JC.exe	28
PID 2760 wrote to memory of 2172	2760	ffb062f9d6c4cfe3e54b87f9366e1ec7_cryptolocker_JC.exe	28
PID 2760 wrote to memory of 2172	2760	ffb062f9d6c4cfe3e54b87f9366e1ec7_cryptolocker_JC.exe	28
PID 2760 wrote to memory of 2172	2760	ffb062f9d6c4cfe3e54b87f9366e1ec7_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\ffb062f9d6c4cfe3e54b87f9366e1ec7_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\ffb062f9d6c4cfe3e54b87f9366e1ec7_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
31KB

MD5
49f917a4c47ec477f96828afe68f9995

SHA1
c6a0a98315c9d201448160ad21217ea35b196762

SHA256
85db3edec9847afcb8fd54cd704b4a54e8cf23b9b5d21b1e3273f1041f28ba98

SHA512
b3113327c0e15235828a34cb96ed4d5090515cece4bad532c288c8dd833b44552c1744d5ab136fb9fb0dbe6f7f69ceb7f520462067c280e6ae02b778b7461d3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
31KB

MD5
49f917a4c47ec477f96828afe68f9995

SHA1
c6a0a98315c9d201448160ad21217ea35b196762

SHA256
85db3edec9847afcb8fd54cd704b4a54e8cf23b9b5d21b1e3273f1041f28ba98

SHA512
b3113327c0e15235828a34cb96ed4d5090515cece4bad532c288c8dd833b44552c1744d5ab136fb9fb0dbe6f7f69ceb7f520462067c280e6ae02b778b7461d3a

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
31KB

MD5
49f917a4c47ec477f96828afe68f9995

SHA1
c6a0a98315c9d201448160ad21217ea35b196762

SHA256
85db3edec9847afcb8fd54cd704b4a54e8cf23b9b5d21b1e3273f1041f28ba98

SHA512
b3113327c0e15235828a34cb96ed4d5090515cece4bad532c288c8dd833b44552c1744d5ab136fb9fb0dbe6f7f69ceb7f520462067c280e6ae02b778b7461d3a

Download Submit
memory/2172-70-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2172-69-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2760-54-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2760-55-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2760-56-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download