d57bc2515bc67d3663a82b47dd0884129297578bf66c0c7f9510a3aa7e927789

Analysis

max time kernel
6s
max time network
9s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2023, 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d47cfd56daadfafaed0a61d8de2cc9d_cryptolocker_JC.exe
Size

74KB
MD5

7d47cfd56daadfafaed0a61d8de2cc9d
SHA1

9b1a06717061491c10ad9e27e196f3ad05ba7e4e
SHA256

d57bc2515bc67d3663a82b47dd0884129297578bf66c0c7f9510a3aa7e927789
SHA512

992ffa3206b91cd01150eb02a790ea684e071de77ce3b64e5a633eac16750c446911201ddc689178769f580e3c07d3898a5fb619d0f5bf20e3d3d0f8c384971a
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfWab:vCjsIOtEvwDpj5H9YvQd2X

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1512	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 1512	3828	7d47cfd56daadfafaed0a61d8de2cc9d_cryptolocker_JC.exe	82
PID 3828 wrote to memory of 1512	3828	7d47cfd56daadfafaed0a61d8de2cc9d_cryptolocker_JC.exe	82
PID 3828 wrote to memory of 1512	3828	7d47cfd56daadfafaed0a61d8de2cc9d_cryptolocker_JC.exe	82

C:\Users\Admin\AppData\Local\Temp\7d47cfd56daadfafaed0a61d8de2cc9d_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\7d47cfd56daadfafaed0a61d8de2cc9d_cryptolocker_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
74KB

MD5
d486d94d84c907f99c0ff4b7ffddc59c

SHA1
6c2ba81142696bd9ee2863ba28f58f47acacd559

SHA256
649c0dd3ae720cee4acb3665536caa6b8d36335451e9b6e3986676227da97165

SHA512
da3d2d6fe6e36fc84b280604c60e1496efd032cf922169d2c26ac80282c9a4a1da3044ef550044d26eb958757122525cd2e66212b37d8a52e73d2ac0335edf16

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
74KB

MD5
d486d94d84c907f99c0ff4b7ffddc59c

SHA1
6c2ba81142696bd9ee2863ba28f58f47acacd559

SHA256
649c0dd3ae720cee4acb3665536caa6b8d36335451e9b6e3986676227da97165

SHA512
da3d2d6fe6e36fc84b280604c60e1496efd032cf922169d2c26ac80282c9a4a1da3044ef550044d26eb958757122525cd2e66212b37d8a52e73d2ac0335edf16

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
74KB

MD5
d486d94d84c907f99c0ff4b7ffddc59c

SHA1
6c2ba81142696bd9ee2863ba28f58f47acacd559

SHA256
649c0dd3ae720cee4acb3665536caa6b8d36335451e9b6e3986676227da97165

SHA512
da3d2d6fe6e36fc84b280604c60e1496efd032cf922169d2c26ac80282c9a4a1da3044ef550044d26eb958757122525cd2e66212b37d8a52e73d2ac0335edf16

Download Submit
memory/3828-0-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/3828-1-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/3828-2-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download