022aec37da8dd4e42f3f9c02b3638517bb717daa6bf0fc2fa8d993380fccd21b

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19-08-2023 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a3d8405399afe7c1b5983c35333ae7a_cryptolocker_JC.exe
Size

36KB
MD5

4a3d8405399afe7c1b5983c35333ae7a
SHA1

be96c87b982753ea54b68712fa21dc557eec9868
SHA256

022aec37da8dd4e42f3f9c02b3638517bb717daa6bf0fc2fa8d993380fccd21b
SHA512

a45861bfe560df6d85943f3e9c86f9cb1d85797d67768d056d4940db1552ab48cc2a372143d409c3b2112b780e6d322f613a799569cbdffb4449383701b4de3c
SSDEEP

384:icX+ni9VCr5nQI021q4VQBqURYp055TOtOOtEvwDpjqIGR/hHgS6BLP1V7UELrpv:XS5nQJ24LR1bytOOtEvwDpj66BLtldv

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2436	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1412	4a3d8405399afe7c1b5983c35333ae7a_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 2436	1412	4a3d8405399afe7c1b5983c35333ae7a_cryptolocker_JC.exe	28
PID 1412 wrote to memory of 2436	1412	4a3d8405399afe7c1b5983c35333ae7a_cryptolocker_JC.exe	28
PID 1412 wrote to memory of 2436	1412	4a3d8405399afe7c1b5983c35333ae7a_cryptolocker_JC.exe	28
PID 1412 wrote to memory of 2436	1412	4a3d8405399afe7c1b5983c35333ae7a_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\4a3d8405399afe7c1b5983c35333ae7a_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\4a3d8405399afe7c1b5983c35333ae7a_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
36KB

MD5
c60f362828d89bd2c5aae7a92644cece

SHA1
5b8f18656e8757e732504cbb92d33918605f0ebf

SHA256
dd8e0b48478199851afcdafbecce21984e35e67e1d2a4c09fb48fc98834b0b3f

SHA512
16e66d9cb55115b970a3ebff8d286923b09c080910ced5d5ad93a50503d9e5bad82386a9575f32a50d0252622849faa2c89b844e05f8a9667f6cdf181a67c670

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
36KB

MD5
c60f362828d89bd2c5aae7a92644cece

SHA1
5b8f18656e8757e732504cbb92d33918605f0ebf

SHA256
dd8e0b48478199851afcdafbecce21984e35e67e1d2a4c09fb48fc98834b0b3f

SHA512
16e66d9cb55115b970a3ebff8d286923b09c080910ced5d5ad93a50503d9e5bad82386a9575f32a50d0252622849faa2c89b844e05f8a9667f6cdf181a67c670

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
36KB

MD5
c60f362828d89bd2c5aae7a92644cece

SHA1
5b8f18656e8757e732504cbb92d33918605f0ebf

SHA256
dd8e0b48478199851afcdafbecce21984e35e67e1d2a4c09fb48fc98834b0b3f

SHA512
16e66d9cb55115b970a3ebff8d286923b09c080910ced5d5ad93a50503d9e5bad82386a9575f32a50d0252622849faa2c89b844e05f8a9667f6cdf181a67c670

Download Submit
memory/1412-56-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/1412-69-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1412-68-0x00000000025C0000-0x00000000025CF000-memory.dmp

Filesize
60KB

Download
memory/1412-55-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/1412-58-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/1412-54-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2436-72-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2436-74-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2436-73-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2436-81-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download