963e43e320b2467555ae3e966ee6ec7fcdc6b6ba66ab25954a7aefb6ea9d6a88

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
23/09/2023, 14:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-08-26_48b52b92331789aa67dd8b9f18c4a254_cryptolocker_JC.exe
Size

78KB
MD5

48b52b92331789aa67dd8b9f18c4a254
SHA1

57223ba8539e33be1f3564928d1abf91876c0b88
SHA256

963e43e320b2467555ae3e966ee6ec7fcdc6b6ba66ab25954a7aefb6ea9d6a88
SHA512

9345a76cb7ab0b45c2b5356ab75f20c62d2772ed2cd7a744571b147276c9bf38c9c2cc1fe3ed268f931c8c8a34c52ea58ebc91a491fba082a161e171f485275d
SSDEEP

1536:zj+soPSMOtEvwDpj4ktBl01hJ0tq1kyJS1jF:zCsanOtEvwDpjT

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3060	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2052	2023-08-26_48b52b92331789aa67dd8b9f18c4a254_cryptolocker_JC.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2052-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x00080000000120be-11.dat	upx
behavioral1/files/0x00080000000120be-16.dat	upx
behavioral1/memory/2052-14-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/3060-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x00080000000120be-26.dat	upx
behavioral1/memory/3060-27-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 3060	2052	2023-08-26_48b52b92331789aa67dd8b9f18c4a254_cryptolocker_JC.exe	29
PID 2052 wrote to memory of 3060	2052	2023-08-26_48b52b92331789aa67dd8b9f18c4a254_cryptolocker_JC.exe	29
PID 2052 wrote to memory of 3060	2052	2023-08-26_48b52b92331789aa67dd8b9f18c4a254_cryptolocker_JC.exe	29
PID 2052 wrote to memory of 3060	2052	2023-08-26_48b52b92331789aa67dd8b9f18c4a254_cryptolocker_JC.exe	29

C:\Users\Admin\AppData\Local\Temp\2023-08-26_48b52b92331789aa67dd8b9f18c4a254_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-26_48b52b92331789aa67dd8b9f18c4a254_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
78KB

MD5
85142eb8650c12b8bee66c514a4d4bf2

SHA1
33d011944010aa622512e405bf4e9b27fb12eb3a

SHA256
6088d8e433029a3c2c22fb03b7a8ac191c3b44c6c21f92aed517ba14049a803a

SHA512
7b173b3fe9a4aa93b75da30575eb79079f33fb943b205666b86e5cfd68ac62ce620be5b659f3000eab50e06ce9b366458c69a1728b7d6d72586547073b6bce77

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
78KB

MD5
85142eb8650c12b8bee66c514a4d4bf2

SHA1
33d011944010aa622512e405bf4e9b27fb12eb3a

SHA256
6088d8e433029a3c2c22fb03b7a8ac191c3b44c6c21f92aed517ba14049a803a

SHA512
7b173b3fe9a4aa93b75da30575eb79079f33fb943b205666b86e5cfd68ac62ce620be5b659f3000eab50e06ce9b366458c69a1728b7d6d72586547073b6bce77

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
78KB

MD5
85142eb8650c12b8bee66c514a4d4bf2

SHA1
33d011944010aa622512e405bf4e9b27fb12eb3a

SHA256
6088d8e433029a3c2c22fb03b7a8ac191c3b44c6c21f92aed517ba14049a803a

SHA512
7b173b3fe9a4aa93b75da30575eb79079f33fb943b205666b86e5cfd68ac62ce620be5b659f3000eab50e06ce9b366458c69a1728b7d6d72586547073b6bce77

Download Submit
memory/2052-15-0x00000000025C0000-0x00000000025D0000-memory.dmp

Filesize
64KB

Download
memory/2052-4-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2052-2-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2052-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2052-14-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2052-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3060-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3060-20-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/3060-19-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3060-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download