c94b515b928cd6cc9ed84e6e24276a0b539d5b48f7fd11dc4acc9a9297b852ee

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
26/08/2023, 13:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2aaef9e755cdd03a01e9056842d01d1_cryptolocker_JC.exe
Size

33KB
MD5

a2aaef9e755cdd03a01e9056842d01d1
SHA1

cbdf45a07b9ff0a10cc1d2c76e5e1ec19e71bc12
SHA256

c94b515b928cd6cc9ed84e6e24276a0b539d5b48f7fd11dc4acc9a9297b852ee
SHA512

8d95ecaee00f0b42ab608206381f2932b283ee0b5de75101be55819864331e3fe8f8db9fdc643cb6fd925be0dd59fd16122f278f58cac23ed232cdfba8eb67ac
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLeM:ZzFbxmLPWQMOtEvwDpjLeM

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1996	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2572	a2aaef9e755cdd03a01e9056842d01d1_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 1996	2572	a2aaef9e755cdd03a01e9056842d01d1_cryptolocker_JC.exe	28
PID 2572 wrote to memory of 1996	2572	a2aaef9e755cdd03a01e9056842d01d1_cryptolocker_JC.exe	28
PID 2572 wrote to memory of 1996	2572	a2aaef9e755cdd03a01e9056842d01d1_cryptolocker_JC.exe	28
PID 2572 wrote to memory of 1996	2572	a2aaef9e755cdd03a01e9056842d01d1_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\a2aaef9e755cdd03a01e9056842d01d1_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\a2aaef9e755cdd03a01e9056842d01d1_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
33KB

MD5
d204f9c9a6199d6c219a3bbc1b315245

SHA1
42bd9aace91561aece7c497be9de123efda83494

SHA256
097640f755e340115827d3db20b4660b6be34dbaf56f805eb48c552470c98fa9

SHA512
63d48516456b25c388ea541a1e0459fa9f8b825c5b8679a86eba4c7b7b24bd99987e19d18fb89ff0bed8911b13a1139e79c59de834e5c64689ec9a68d2f65442

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
33KB

MD5
d204f9c9a6199d6c219a3bbc1b315245

SHA1
42bd9aace91561aece7c497be9de123efda83494

SHA256
097640f755e340115827d3db20b4660b6be34dbaf56f805eb48c552470c98fa9

SHA512
63d48516456b25c388ea541a1e0459fa9f8b825c5b8679a86eba4c7b7b24bd99987e19d18fb89ff0bed8911b13a1139e79c59de834e5c64689ec9a68d2f65442

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
33KB

MD5
d204f9c9a6199d6c219a3bbc1b315245

SHA1
42bd9aace91561aece7c497be9de123efda83494

SHA256
097640f755e340115827d3db20b4660b6be34dbaf56f805eb48c552470c98fa9

SHA512
63d48516456b25c388ea541a1e0459fa9f8b825c5b8679a86eba4c7b7b24bd99987e19d18fb89ff0bed8911b13a1139e79c59de834e5c64689ec9a68d2f65442

Download Submit
memory/1996-14-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1996-17-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/1996-16-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2572-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2572-1-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2572-2-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download