f555e664fdf51de0bee5d65edd8a6af1502bb51a229d6e8e842f0b9e4c89bc4c

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02/10/2023, 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-08-27_33ce1d5c94ab14ce7b017ce38c6c493d_cryptolocker_JC.exe
Size

45KB
MD5

33ce1d5c94ab14ce7b017ce38c6c493d
SHA1

771d73e570fa1274f0de17ab37914dc19508614f
SHA256

f555e664fdf51de0bee5d65edd8a6af1502bb51a229d6e8e842f0b9e4c89bc4c
SHA512

fc25c5b07d7ee6e9047d1b61c0fc0b5d010f0a172ece1a32b00744f5a7d83f6b4184f6d1b56d4522adf96a73e230f2ae4e7b616a4cd8fd303a74256793c1812b
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrr42A7n0P:vj+jsMQMOtEvwDpj5HczerLO0P

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2160	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2980	2023-08-27_33ce1d5c94ab14ce7b017ce38c6c493d_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2160	2980	2023-08-27_33ce1d5c94ab14ce7b017ce38c6c493d_cryptolocker_JC.exe	28
PID 2980 wrote to memory of 2160	2980	2023-08-27_33ce1d5c94ab14ce7b017ce38c6c493d_cryptolocker_JC.exe	28
PID 2980 wrote to memory of 2160	2980	2023-08-27_33ce1d5c94ab14ce7b017ce38c6c493d_cryptolocker_JC.exe	28
PID 2980 wrote to memory of 2160	2980	2023-08-27_33ce1d5c94ab14ce7b017ce38c6c493d_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\2023-08-27_33ce1d5c94ab14ce7b017ce38c6c493d_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-27_33ce1d5c94ab14ce7b017ce38c6c493d_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
45KB

MD5
f896f0a9e9a9073dcda3bdd58218b4ec

SHA1
5022d35a06d3d59f99e1c9dbc0d7769d16402288

SHA256
6366be248b648e320a30f643c3ba8c4f443657bcb240aad6881027d33fc564e0

SHA512
37070227288f126e6ebbf757287bc62a161017487fa994e5b87da99d5e54c55fd8c3b2ef6c77b19a73ad05094062ebeee1b610466a82e7b555299cce2a74ff48

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
45KB

MD5
f896f0a9e9a9073dcda3bdd58218b4ec

SHA1
5022d35a06d3d59f99e1c9dbc0d7769d16402288

SHA256
6366be248b648e320a30f643c3ba8c4f443657bcb240aad6881027d33fc564e0

SHA512
37070227288f126e6ebbf757287bc62a161017487fa994e5b87da99d5e54c55fd8c3b2ef6c77b19a73ad05094062ebeee1b610466a82e7b555299cce2a74ff48

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
45KB

MD5
f896f0a9e9a9073dcda3bdd58218b4ec

SHA1
5022d35a06d3d59f99e1c9dbc0d7769d16402288

SHA256
6366be248b648e320a30f643c3ba8c4f443657bcb240aad6881027d33fc564e0

SHA512
37070227288f126e6ebbf757287bc62a161017487fa994e5b87da99d5e54c55fd8c3b2ef6c77b19a73ad05094062ebeee1b610466a82e7b555299cce2a74ff48

Download Submit
memory/2160-15-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/2160-16-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2980-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2980-1-0x0000000001C90000-0x0000000001C96000-memory.dmp

Filesize
24KB

Download
memory/2980-2-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download