996cedd811dd1e73d8b78d4cc513b97a6394009c3ae5c5061a3983e57dec3f02

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20/08/2023, 10:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4f787b9945219cfb2169a7bc13154453_cryptolocker_JC.exe
Size

71KB
MD5

4f787b9945219cfb2169a7bc13154453
SHA1

0c048ca724b54f560c1fe52975598553ace9e044
SHA256

996cedd811dd1e73d8b78d4cc513b97a6394009c3ae5c5061a3983e57dec3f02
SHA512

95b2d63222460c097fa81b2478ef00ad8009b47e95efdc6bedf148c2d5e33390081739c1e83f28c87bed3aa68e53542e0c5a7989886771ea56e6aa0235a380a7
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4U9HueDgaRWDtJgXX6:vj+jsMQMOtEvwDpj5H8u8rLXq

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1356	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2504	4f787b9945219cfb2169a7bc13154453_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 1356	2504	4f787b9945219cfb2169a7bc13154453_cryptolocker_JC.exe	28
PID 2504 wrote to memory of 1356	2504	4f787b9945219cfb2169a7bc13154453_cryptolocker_JC.exe	28
PID 2504 wrote to memory of 1356	2504	4f787b9945219cfb2169a7bc13154453_cryptolocker_JC.exe	28
PID 2504 wrote to memory of 1356	2504	4f787b9945219cfb2169a7bc13154453_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\4f787b9945219cfb2169a7bc13154453_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\4f787b9945219cfb2169a7bc13154453_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
71KB

MD5
dea6ed776fc7abd6702a2fd858246c99

SHA1
abd548200290b284fef2ec7abcf44e3c77b6433d

SHA256
2d2804c0d346596f7a98099a6410ab3280e721dd1bb8dc2855e32349549ea1e1

SHA512
cba635f7779d3d393d9377479cfc8ab2a9ca5b4cbdbc799493d34facbb26addbe7dfaf7cd9deafabe744eca7bf64fbd31f3d136ff76dcdae48adac9c9775467d

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
71KB

MD5
dea6ed776fc7abd6702a2fd858246c99

SHA1
abd548200290b284fef2ec7abcf44e3c77b6433d

SHA256
2d2804c0d346596f7a98099a6410ab3280e721dd1bb8dc2855e32349549ea1e1

SHA512
cba635f7779d3d393d9377479cfc8ab2a9ca5b4cbdbc799493d34facbb26addbe7dfaf7cd9deafabe744eca7bf64fbd31f3d136ff76dcdae48adac9c9775467d

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
71KB

MD5
dea6ed776fc7abd6702a2fd858246c99

SHA1
abd548200290b284fef2ec7abcf44e3c77b6433d

SHA256
2d2804c0d346596f7a98099a6410ab3280e721dd1bb8dc2855e32349549ea1e1

SHA512
cba635f7779d3d393d9377479cfc8ab2a9ca5b4cbdbc799493d34facbb26addbe7dfaf7cd9deafabe744eca7bf64fbd31f3d136ff76dcdae48adac9c9775467d

Download Submit
memory/1356-70-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/1356-69-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2504-54-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2504-56-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2504-55-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download