b45582d97fc363455618bd1472f4b291db4e67ec5f51c41953ec400898b7496d

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
26/08/2023, 20:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a68688ed7e1950cc6f6511b549b130c7_cryptolocker_JC.exe
Size

50KB
MD5

a68688ed7e1950cc6f6511b549b130c7
SHA1

70d0afb1e0748417e2bbc00b1fccd8382fd4f779
SHA256

b45582d97fc363455618bd1472f4b291db4e67ec5f51c41953ec400898b7496d
SHA512

26e62c1fd54cfb696fb4aa0b97189739a75b1d879663d0ef413dbad83bd41cd670c97fcb9a502c65028a8ef731cd96b608677a33854d57c15ffe665036965bd3
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5QCj+:6j+1NMOtEvwDpjr8oxEg+

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2948	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2528	a68688ed7e1950cc6f6511b549b130c7_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2948	2528	a68688ed7e1950cc6f6511b549b130c7_cryptolocker_JC.exe	28
PID 2528 wrote to memory of 2948	2528	a68688ed7e1950cc6f6511b549b130c7_cryptolocker_JC.exe	28
PID 2528 wrote to memory of 2948	2528	a68688ed7e1950cc6f6511b549b130c7_cryptolocker_JC.exe	28
PID 2528 wrote to memory of 2948	2528	a68688ed7e1950cc6f6511b549b130c7_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\a68688ed7e1950cc6f6511b549b130c7_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\a68688ed7e1950cc6f6511b549b130c7_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
50KB

MD5
475e28cad9405e82e814dfcc37312c4a

SHA1
4fc691306222014ef8e0a2f575ccfd04028618ac

SHA256
e6fe1274fa34ae0bb7d1ddddc9ae7c4401b3446ba0cd4563c6f7e64fd139a00c

SHA512
d86b1c9d93372d61b8fa7da25124694fb729261267849a53393f82868c18ce6042eddff93cc457f77ed27c0b7299059e044cd82448b441b5841caf358734d98d

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
50KB

MD5
475e28cad9405e82e814dfcc37312c4a

SHA1
4fc691306222014ef8e0a2f575ccfd04028618ac

SHA256
e6fe1274fa34ae0bb7d1ddddc9ae7c4401b3446ba0cd4563c6f7e64fd139a00c

SHA512
d86b1c9d93372d61b8fa7da25124694fb729261267849a53393f82868c18ce6042eddff93cc457f77ed27c0b7299059e044cd82448b441b5841caf358734d98d

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
50KB

MD5
475e28cad9405e82e814dfcc37312c4a

SHA1
4fc691306222014ef8e0a2f575ccfd04028618ac

SHA256
e6fe1274fa34ae0bb7d1ddddc9ae7c4401b3446ba0cd4563c6f7e64fd139a00c

SHA512
d86b1c9d93372d61b8fa7da25124694fb729261267849a53393f82868c18ce6042eddff93cc457f77ed27c0b7299059e044cd82448b441b5841caf358734d98d

Download Submit
memory/2528-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2528-1-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2528-3-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2528-2-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/2528-14-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2948-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2948-18-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2948-19-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2948-26-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download