450badc7b1394e949c0f321477be832bb0364b4f34fbe4cdbc73c35004ef2948

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
29/08/2023, 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d10bfed59bedf42ebd33d6cbf82a852c_cryptolocker_JC.exe
Size

87KB
MD5

d10bfed59bedf42ebd33d6cbf82a852c
SHA1

a9c378814176536c1d4531e480a3a50206143360
SHA256

450badc7b1394e949c0f321477be832bb0364b4f34fbe4cdbc73c35004ef2948
SHA512

5bd83e9dc1d9e73490433ec2e5b4423c1988eb3fe290afae9631c3725ea7fbfc16765ae01c3ecd51febccae77b44025649148b4938477784b81ac97c37b6eb10
SSDEEP

1536:vj+jsMQMOtEvwDpj5H8u8rBN6nqEZNieRpv:vCjsIOtEvwDpj5H8zPG

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2556	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1660	d10bfed59bedf42ebd33d6cbf82a852c_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2556	1660	d10bfed59bedf42ebd33d6cbf82a852c_cryptolocker_JC.exe	28
PID 1660 wrote to memory of 2556	1660	d10bfed59bedf42ebd33d6cbf82a852c_cryptolocker_JC.exe	28
PID 1660 wrote to memory of 2556	1660	d10bfed59bedf42ebd33d6cbf82a852c_cryptolocker_JC.exe	28
PID 1660 wrote to memory of 2556	1660	d10bfed59bedf42ebd33d6cbf82a852c_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\d10bfed59bedf42ebd33d6cbf82a852c_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\d10bfed59bedf42ebd33d6cbf82a852c_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
87KB

MD5
096e5527af3778ae509a9556c51f125f

SHA1
5d3922c6f72f6f449fe3a3d2526b42124b315060

SHA256
292daddb842fd7a4e20d29f30b469ad926fc4d5f12330725516b60043112c3f4

SHA512
d9be4d18ac5aa50908fa9f4829077022139f0facbc150238c802911783b16898c92e4edb8147d6e0b723d3135d1768e153b3ca7b6e18d8bf33474267fc3ac2a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
87KB

MD5
096e5527af3778ae509a9556c51f125f

SHA1
5d3922c6f72f6f449fe3a3d2526b42124b315060

SHA256
292daddb842fd7a4e20d29f30b469ad926fc4d5f12330725516b60043112c3f4

SHA512
d9be4d18ac5aa50908fa9f4829077022139f0facbc150238c802911783b16898c92e4edb8147d6e0b723d3135d1768e153b3ca7b6e18d8bf33474267fc3ac2a6

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
87KB

MD5
096e5527af3778ae509a9556c51f125f

SHA1
5d3922c6f72f6f449fe3a3d2526b42124b315060

SHA256
292daddb842fd7a4e20d29f30b469ad926fc4d5f12330725516b60043112c3f4

SHA512
d9be4d18ac5aa50908fa9f4829077022139f0facbc150238c802911783b16898c92e4edb8147d6e0b723d3135d1768e153b3ca7b6e18d8bf33474267fc3ac2a6

Download Submit
memory/1660-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1660-1-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/1660-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2556-16-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2556-15-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download