2a1502598bc6e3baf030a4601c989460faa1884974e8fe6c7eb7e6a52f5349a5

Analysis

max time kernel
131s
max time network
145s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
29/08/2023, 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d668bc8a6377ce71f5b3c4e981f907a6_cryptolocker_JC.exe
Size

88KB
MD5

d668bc8a6377ce71f5b3c4e981f907a6
SHA1

876631b43c29d1a51a48fab7408a050372230ce2
SHA256

2a1502598bc6e3baf030a4601c989460faa1884974e8fe6c7eb7e6a52f5349a5
SHA512

945367de102c9b2a14f8b125ba60f91eee3e3c71f617f8f47c497f9a9af149a8172d6423b42e6864eca1bdcf35de1c0b8978fff6346095dc242b5bd1249b52c0
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWNa9mM:xj+VGMOtEvwDpjubwQEIiVmM

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2908	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2296	d668bc8a6377ce71f5b3c4e981f907a6_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2908	2296	d668bc8a6377ce71f5b3c4e981f907a6_cryptolocker_JC.exe	28
PID 2296 wrote to memory of 2908	2296	d668bc8a6377ce71f5b3c4e981f907a6_cryptolocker_JC.exe	28
PID 2296 wrote to memory of 2908	2296	d668bc8a6377ce71f5b3c4e981f907a6_cryptolocker_JC.exe	28
PID 2296 wrote to memory of 2908	2296	d668bc8a6377ce71f5b3c4e981f907a6_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\d668bc8a6377ce71f5b3c4e981f907a6_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\d668bc8a6377ce71f5b3c4e981f907a6_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
89KB

MD5
f27e7337dae7da2b4683f33b9ce70fe7

SHA1
e62e81500d7324d7dc34ce66da207288a7c62d1f

SHA256
f6a3f35631f3d266f108f052eb21c6647be23579211a4fc9ff5be347b266b284

SHA512
c421340e7e49f8d755b2d3d7b8a25d2c8cc1e09ef3dcc3656485c7a78746c5bdc5e27e6f77e10bb2c4e61f7535593ea379ce4e8f95c887341c765919f4ab6577

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
89KB

MD5
f27e7337dae7da2b4683f33b9ce70fe7

SHA1
e62e81500d7324d7dc34ce66da207288a7c62d1f

SHA256
f6a3f35631f3d266f108f052eb21c6647be23579211a4fc9ff5be347b266b284

SHA512
c421340e7e49f8d755b2d3d7b8a25d2c8cc1e09ef3dcc3656485c7a78746c5bdc5e27e6f77e10bb2c4e61f7535593ea379ce4e8f95c887341c765919f4ab6577

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
89KB

MD5
f27e7337dae7da2b4683f33b9ce70fe7

SHA1
e62e81500d7324d7dc34ce66da207288a7c62d1f

SHA256
f6a3f35631f3d266f108f052eb21c6647be23579211a4fc9ff5be347b266b284

SHA512
c421340e7e49f8d755b2d3d7b8a25d2c8cc1e09ef3dcc3656485c7a78746c5bdc5e27e6f77e10bb2c4e61f7535593ea379ce4e8f95c887341c765919f4ab6577

Download Submit
memory/2296-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2296-2-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/2296-4-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2296-1-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2296-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2908-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2908-19-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2908-18-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/2908-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download