ab612de932f1dd675bb2a17c0f9a1762c23c02b960986c2dc191beddfb7803f0

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20-08-2023 11:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53a7802483586c28e247ec8eaa17c5ba_cryptolocker_JC.exe
Size

58KB
MD5

53a7802483586c28e247ec8eaa17c5ba
SHA1

69d89e0e87c6fde886704476a2b152c0250faf3c
SHA256

ab612de932f1dd675bb2a17c0f9a1762c23c02b960986c2dc191beddfb7803f0
SHA512

4cdfa34932ff967065fae36deaa4c9a326cf7c63027c3845a2c89bf7a9dac462d671a28e888f988840eccef453c530adbdd1953c75f813eb18e1732def4fcca3
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8z2iaSIO/RvDQeduJHqqnz10Lhs:ZzFbxmLPWQMOtEvwDpj386Sj/RsB0q

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2680	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2572	53a7802483586c28e247ec8eaa17c5ba_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 2680	2572	53a7802483586c28e247ec8eaa17c5ba_cryptolocker_JC.exe	28
PID 2572 wrote to memory of 2680	2572	53a7802483586c28e247ec8eaa17c5ba_cryptolocker_JC.exe	28
PID 2572 wrote to memory of 2680	2572	53a7802483586c28e247ec8eaa17c5ba_cryptolocker_JC.exe	28
PID 2572 wrote to memory of 2680	2572	53a7802483586c28e247ec8eaa17c5ba_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\53a7802483586c28e247ec8eaa17c5ba_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\53a7802483586c28e247ec8eaa17c5ba_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
58KB

MD5
f2bad4eb80acd45086aa3077620a5f57

SHA1
e2c463064f09dbfa913e7645df5cba67692b76dc

SHA256
e660bc82d380b8ee5df96d76894537881f9746ea6a6519f6401b0eb65a9e6af8

SHA512
c136503fd19a028d6a6b7111ef57cce222e9c4ebffd8d8ab0f7339a6cf6d9fb0dacb6c10d94b78bb816f56f952b242b4923234057b5adb0701f74d7ae4c074ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
58KB

MD5
f2bad4eb80acd45086aa3077620a5f57

SHA1
e2c463064f09dbfa913e7645df5cba67692b76dc

SHA256
e660bc82d380b8ee5df96d76894537881f9746ea6a6519f6401b0eb65a9e6af8

SHA512
c136503fd19a028d6a6b7111ef57cce222e9c4ebffd8d8ab0f7339a6cf6d9fb0dacb6c10d94b78bb816f56f952b242b4923234057b5adb0701f74d7ae4c074ce

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
58KB

MD5
f2bad4eb80acd45086aa3077620a5f57

SHA1
e2c463064f09dbfa913e7645df5cba67692b76dc

SHA256
e660bc82d380b8ee5df96d76894537881f9746ea6a6519f6401b0eb65a9e6af8

SHA512
c136503fd19a028d6a6b7111ef57cce222e9c4ebffd8d8ab0f7339a6cf6d9fb0dacb6c10d94b78bb816f56f952b242b4923234057b5adb0701f74d7ae4c074ce

Download Submit
memory/2572-54-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2572-55-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2572-56-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2680-68-0x0000000000240000-0x0000000000243000-memory.dmp

Filesize
12KB

Download
memory/2680-71-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2680-70-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2680-78-0x0000000000240000-0x0000000000243000-memory.dmp

Filesize
12KB

Download