f0277571c58b9654905c81e97d66177f574bea37b9c0e3eeb0186642588f978b

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
28-08-2023 16:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf960c93f14677fd48c6448e23b1164e_cryptolocker_JC.exe
Size

74KB
MD5

bf960c93f14677fd48c6448e23b1164e
SHA1

a52bb539d9f349012e0682d4aa9553370c4e4528
SHA256

f0277571c58b9654905c81e97d66177f574bea37b9c0e3eeb0186642588f978b
SHA512

a24dc5e3bca5b3fe054f44d6ffbc480c400164bff5fc8cbd00d1f868c0278b6b761d05e3951fb198ed6891db1e8eede618c0b22b45d02bbaff20c98c29f0f46c
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfWaw:vCjsIOtEvwDpj5H9YvQd2s

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2912	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2908	bf960c93f14677fd48c6448e23b1164e_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2912	2908	bf960c93f14677fd48c6448e23b1164e_cryptolocker_JC.exe	28
PID 2908 wrote to memory of 2912	2908	bf960c93f14677fd48c6448e23b1164e_cryptolocker_JC.exe	28
PID 2908 wrote to memory of 2912	2908	bf960c93f14677fd48c6448e23b1164e_cryptolocker_JC.exe	28
PID 2908 wrote to memory of 2912	2908	bf960c93f14677fd48c6448e23b1164e_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\bf960c93f14677fd48c6448e23b1164e_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\bf960c93f14677fd48c6448e23b1164e_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
74KB

MD5
1c95d3b6e67807d7453c7be747a75724

SHA1
204aad5de99a14b128fe66443de68da97801869e

SHA256
44a50f55bacad5a868e5df0ff8b0a4098919363862131b66df39c888dc3e26c3

SHA512
a3a896cb70c14ae64652fd07f1973816a4b57b05102a307187d06f574a1c697c0c1e1472bbb40589ae58f525c70bb3a8075bd862b4e0eefefbf6bd4069268ef2

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
74KB

MD5
1c95d3b6e67807d7453c7be747a75724

SHA1
204aad5de99a14b128fe66443de68da97801869e

SHA256
44a50f55bacad5a868e5df0ff8b0a4098919363862131b66df39c888dc3e26c3

SHA512
a3a896cb70c14ae64652fd07f1973816a4b57b05102a307187d06f574a1c697c0c1e1472bbb40589ae58f525c70bb3a8075bd862b4e0eefefbf6bd4069268ef2

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
74KB

MD5
1c95d3b6e67807d7453c7be747a75724

SHA1
204aad5de99a14b128fe66443de68da97801869e

SHA256
44a50f55bacad5a868e5df0ff8b0a4098919363862131b66df39c888dc3e26c3

SHA512
a3a896cb70c14ae64652fd07f1973816a4b57b05102a307187d06f574a1c697c0c1e1472bbb40589ae58f525c70bb3a8075bd862b4e0eefefbf6bd4069268ef2

Download Submit
memory/2908-0-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2908-1-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2908-2-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2912-16-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2912-15-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download