0b8e4542c97d98e0944c3883a7b0291cebdef58953ed890e73eef95484293937

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02/10/2023, 14:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-08-27_05c86f8fa4f563eb7c1d059c0f3db3dd_cryptolocker_JC.exe
Size

81KB
MD5

05c86f8fa4f563eb7c1d059c0f3db3dd
SHA1

85fe6045c100cd34e44613e94a82e19c638486a1
SHA256

0b8e4542c97d98e0944c3883a7b0291cebdef58953ed890e73eef95484293937
SHA512

08ce4090762d63a9e639c0554703490744af2e9631d60c9ad65d5369a69b6c20525c6531bdd9fafc58e0262a0e9ec6355087d2a829f56c15fa21e0879e2c9dc9
SSDEEP

768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRXrZSUfFKazNclMjNUve:i5nkFGMOtEvwDpjNbwQEI8UtzNcO8e

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2940	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2984	2023-08-27_05c86f8fa4f563eb7c1d059c0f3db3dd_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2940	2984	2023-08-27_05c86f8fa4f563eb7c1d059c0f3db3dd_cryptolocker_JC.exe	28
PID 2984 wrote to memory of 2940	2984	2023-08-27_05c86f8fa4f563eb7c1d059c0f3db3dd_cryptolocker_JC.exe	28
PID 2984 wrote to memory of 2940	2984	2023-08-27_05c86f8fa4f563eb7c1d059c0f3db3dd_cryptolocker_JC.exe	28
PID 2984 wrote to memory of 2940	2984	2023-08-27_05c86f8fa4f563eb7c1d059c0f3db3dd_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\2023-08-27_05c86f8fa4f563eb7c1d059c0f3db3dd_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-27_05c86f8fa4f563eb7c1d059c0f3db3dd_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
82KB

MD5
eb357817746687fb3b1c7adb6669eded

SHA1
3bc21fd994e1074b76df7b8e75e62e219938fefb

SHA256
73cf116ed2352542a7d69905951f39736287de5c6081cf8dc4c3b881dc7977ea

SHA512
95c7bc19b9764a56a14866d45d459fdaf922824810caf8c4f41bec5ddcc06232f727c7096825a1b014b9a700668c4270e736a9e46a48593bab4ae8ca8e9ec8f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
82KB

MD5
eb357817746687fb3b1c7adb6669eded

SHA1
3bc21fd994e1074b76df7b8e75e62e219938fefb

SHA256
73cf116ed2352542a7d69905951f39736287de5c6081cf8dc4c3b881dc7977ea

SHA512
95c7bc19b9764a56a14866d45d459fdaf922824810caf8c4f41bec5ddcc06232f727c7096825a1b014b9a700668c4270e736a9e46a48593bab4ae8ca8e9ec8f8

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
82KB

MD5
eb357817746687fb3b1c7adb6669eded

SHA1
3bc21fd994e1074b76df7b8e75e62e219938fefb

SHA256
73cf116ed2352542a7d69905951f39736287de5c6081cf8dc4c3b881dc7977ea

SHA512
95c7bc19b9764a56a14866d45d459fdaf922824810caf8c4f41bec5ddcc06232f727c7096825a1b014b9a700668c4270e736a9e46a48593bab4ae8ca8e9ec8f8

Download Submit
memory/2940-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2940-27-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2984-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2984-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2984-2-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2984-4-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2984-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2984-14-0x0000000000690000-0x000000000069F000-memory.dmp

Filesize
60KB

Download
memory/2984-26-0x0000000000690000-0x000000000069F000-memory.dmp

Filesize
60KB

Download