7cd10ab2757527b6fbdd2d30cd4666e0ddbf482aab148bf1d6db50c651263004

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02-10-2023 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-08-27_3d2e5447ff594ded2d99104e3754c131_cryptolocker_JC.exe
Size

124KB
MD5

3d2e5447ff594ded2d99104e3754c131
SHA1

104274dbfd235f22b0c871c91b80036c6e68d986
SHA256

7cd10ab2757527b6fbdd2d30cd4666e0ddbf482aab148bf1d6db50c651263004
SHA512

adf04e3775f5a351314f38cd28fd290a29717fd33d71c4ea9e0672de105093f1d96b20a65bdd6af69a2d40537527fbac44724b2514fbd50a3e8cb603b3952c6b
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfIuBKLUYOVZppU:vCjsIOtEvwDpj5H9YvQd2w

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2484	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2032	2023-08-27_3d2e5447ff594ded2d99104e3754c131_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2484	2032	2023-08-27_3d2e5447ff594ded2d99104e3754c131_cryptolocker_JC.exe	28
PID 2032 wrote to memory of 2484	2032	2023-08-27_3d2e5447ff594ded2d99104e3754c131_cryptolocker_JC.exe	28
PID 2032 wrote to memory of 2484	2032	2023-08-27_3d2e5447ff594ded2d99104e3754c131_cryptolocker_JC.exe	28
PID 2032 wrote to memory of 2484	2032	2023-08-27_3d2e5447ff594ded2d99104e3754c131_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\2023-08-27_3d2e5447ff594ded2d99104e3754c131_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-27_3d2e5447ff594ded2d99104e3754c131_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
124KB

MD5
bc5480a9685ba4c43acd8c56193906d9

SHA1
3f5eb4225fcaaf982d64d2f80e9ccd7c0ef11de2

SHA256
912964bfea994a4e80332f1cb42f1beba96ab12708d652575f9e43f20990fff0

SHA512
52507dcfb7799d1ff92396e1fd0f985c458cc3d28065e93b2f5edde46da56080b1a43d4fc16663183cdd56622a07333f30347dd49f4434e4436cc23d5b40b85f

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
124KB

MD5
bc5480a9685ba4c43acd8c56193906d9

SHA1
3f5eb4225fcaaf982d64d2f80e9ccd7c0ef11de2

SHA256
912964bfea994a4e80332f1cb42f1beba96ab12708d652575f9e43f20990fff0

SHA512
52507dcfb7799d1ff92396e1fd0f985c458cc3d28065e93b2f5edde46da56080b1a43d4fc16663183cdd56622a07333f30347dd49f4434e4436cc23d5b40b85f

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
124KB

MD5
bc5480a9685ba4c43acd8c56193906d9

SHA1
3f5eb4225fcaaf982d64d2f80e9ccd7c0ef11de2

SHA256
912964bfea994a4e80332f1cb42f1beba96ab12708d652575f9e43f20990fff0

SHA512
52507dcfb7799d1ff92396e1fd0f985c458cc3d28065e93b2f5edde46da56080b1a43d4fc16663183cdd56622a07333f30347dd49f4434e4436cc23d5b40b85f

Download Submit
memory/2032-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2032-2-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2032-1-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2484-16-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/2484-15-0x0000000001CD0000-0x0000000001CD6000-memory.dmp

Filesize
24KB

Download