7ecdb1440bdac31a9f8d4155af4a0b6358eb2dc0898fc625bab377fe1ca9e6b2

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
23/09/2023, 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-08-26_3e90587dba039d9564841b33aee0865c_cryptolocker_JC.exe
Size

32KB
MD5

3e90587dba039d9564841b33aee0865c
SHA1

d8a756f8b37c9a1991688b777c16713ba9bf6e82
SHA256

7ecdb1440bdac31a9f8d4155af4a0b6358eb2dc0898fc625bab377fe1ca9e6b2
SHA512

aa747b0634a95aa378c558131f504a6a0dd00e9d7652bb3da29af8eb22e4522b5e132e0a1e7ef3a137ac8049213bac2f4a25b60cd68b214735f9a05db85bc34a
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLeF:ZzFbxmLPWQMOtEvwDpjLeF

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2628	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2864	2023-08-26_3e90587dba039d9564841b33aee0865c_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2628	2864	2023-08-26_3e90587dba039d9564841b33aee0865c_cryptolocker_JC.exe	28
PID 2864 wrote to memory of 2628	2864	2023-08-26_3e90587dba039d9564841b33aee0865c_cryptolocker_JC.exe	28
PID 2864 wrote to memory of 2628	2864	2023-08-26_3e90587dba039d9564841b33aee0865c_cryptolocker_JC.exe	28
PID 2864 wrote to memory of 2628	2864	2023-08-26_3e90587dba039d9564841b33aee0865c_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\2023-08-26_3e90587dba039d9564841b33aee0865c_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-26_3e90587dba039d9564841b33aee0865c_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
33KB

MD5
fa4394f4585b47ab9736d39e843b60e9

SHA1
b8f8f8921b1a61f7e50fa6e19e01458c0d75cfbf

SHA256
4df2a309e68dd86db224a9b92a5b15ad628e541ef939fc65617a19c7c43736f9

SHA512
6f9fb9a77c7f700dea44a17104e1aad261cf09b74996a68955590571253da8d271dbd91099e2187c429363e522db57dd5912cef769b7c86e9d717a2b138719d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
33KB

MD5
fa4394f4585b47ab9736d39e843b60e9

SHA1
b8f8f8921b1a61f7e50fa6e19e01458c0d75cfbf

SHA256
4df2a309e68dd86db224a9b92a5b15ad628e541ef939fc65617a19c7c43736f9

SHA512
6f9fb9a77c7f700dea44a17104e1aad261cf09b74996a68955590571253da8d271dbd91099e2187c429363e522db57dd5912cef769b7c86e9d717a2b138719d6

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
33KB

MD5
fa4394f4585b47ab9736d39e843b60e9

SHA1
b8f8f8921b1a61f7e50fa6e19e01458c0d75cfbf

SHA256
4df2a309e68dd86db224a9b92a5b15ad628e541ef939fc65617a19c7c43736f9

SHA512
6f9fb9a77c7f700dea44a17104e1aad261cf09b74996a68955590571253da8d271dbd91099e2187c429363e522db57dd5912cef769b7c86e9d717a2b138719d6

Download Submit
memory/2628-14-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2628-16-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2628-23-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2864-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2864-2-0x0000000000410000-0x0000000000416000-memory.dmp

Filesize
24KB

Download
memory/2864-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download