d2cf7b30fed1db7d6b64d5a5e16b76cb39b842351e216dd4898e25c1d5c8c20a

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20/08/2023, 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fd5aa66a0d427b405324b1786b182c2_cryptolocker_JC.exe
Size

49KB
MD5

4fd5aa66a0d427b405324b1786b182c2
SHA1

fcb5d90323f8a552087c610651c79d6deafe99be
SHA256

d2cf7b30fed1db7d6b64d5a5e16b76cb39b842351e216dd4898e25c1d5c8c20a
SHA512

f09e606c9767ebf6358cc631da4a7033a5d70d24d8809c46cd19f160d522aecd03968df00c367808a642f0ff415e94f726a77d9c97a9b40acb6a53fe202143dd
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4hdCW1nw71TkhsiPn1YFvs:vj+jsMQMOtEvwDpj5HH1nw73KOFE

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2796	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2856	4fd5aa66a0d427b405324b1786b182c2_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2796	2856	4fd5aa66a0d427b405324b1786b182c2_cryptolocker_JC.exe	28
PID 2856 wrote to memory of 2796	2856	4fd5aa66a0d427b405324b1786b182c2_cryptolocker_JC.exe	28
PID 2856 wrote to memory of 2796	2856	4fd5aa66a0d427b405324b1786b182c2_cryptolocker_JC.exe	28
PID 2856 wrote to memory of 2796	2856	4fd5aa66a0d427b405324b1786b182c2_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\4fd5aa66a0d427b405324b1786b182c2_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\4fd5aa66a0d427b405324b1786b182c2_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
50KB

MD5
05880a4ad436fc8ae18afb5b62debd3f

SHA1
29680c40cc4d65df18f56d7354cf3e28f322e893

SHA256
6760afece0324889505b9038d05ed5bdddf3c0e3eec047b356e8d3e97c8b57ac

SHA512
6de91318e59dc50fbc8099f99278559738f3a6404469474af549a51ac1136e894750740e6cd47c97f63a6078b4a86d8b17c12cf8700560f0c8739290f8dece8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
50KB

MD5
05880a4ad436fc8ae18afb5b62debd3f

SHA1
29680c40cc4d65df18f56d7354cf3e28f322e893

SHA256
6760afece0324889505b9038d05ed5bdddf3c0e3eec047b356e8d3e97c8b57ac

SHA512
6de91318e59dc50fbc8099f99278559738f3a6404469474af549a51ac1136e894750740e6cd47c97f63a6078b4a86d8b17c12cf8700560f0c8739290f8dece8d

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
50KB

MD5
05880a4ad436fc8ae18afb5b62debd3f

SHA1
29680c40cc4d65df18f56d7354cf3e28f322e893

SHA256
6760afece0324889505b9038d05ed5bdddf3c0e3eec047b356e8d3e97c8b57ac

SHA512
6de91318e59dc50fbc8099f99278559738f3a6404469474af549a51ac1136e894750740e6cd47c97f63a6078b4a86d8b17c12cf8700560f0c8739290f8dece8d

Download Submit
memory/2796-68-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2796-69-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2856-53-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2856-54-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2856-56-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download