beece8d337b7ff3759e7d0cce126ea949cb9bcd8f997021c35ac9383629c58d8

Analysis

max time kernel
198s
max time network
204s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 10:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-08-26_981b6b1905150c8ab499851e80016c4f_cryptolocker_JC.exe
Size

52KB
MD5

981b6b1905150c8ab499851e80016c4f
SHA1

bad673324050563e2bb0f871a4dec4a0d2128e18
SHA256

beece8d337b7ff3759e7d0cce126ea949cb9bcd8f997021c35ac9383629c58d8
SHA512

ed1201463193fc6538ad79ceff759917219613a10595424b67c284302d6c845cfff8d34c053c80fa67a91b7f11b7267e24462e4e01b5ca3ab9255c813cf60dde
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZgBh8i6g7Go1:xj+VGMOtEvwDpjubEgY

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2688	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2768	2023-08-26_981b6b1905150c8ab499851e80016c4f_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2688	2768	2023-08-26_981b6b1905150c8ab499851e80016c4f_cryptolocker_JC.exe	29
PID 2768 wrote to memory of 2688	2768	2023-08-26_981b6b1905150c8ab499851e80016c4f_cryptolocker_JC.exe	29
PID 2768 wrote to memory of 2688	2768	2023-08-26_981b6b1905150c8ab499851e80016c4f_cryptolocker_JC.exe	29
PID 2768 wrote to memory of 2688	2768	2023-08-26_981b6b1905150c8ab499851e80016c4f_cryptolocker_JC.exe	29

C:\Users\Admin\AppData\Local\Temp\2023-08-26_981b6b1905150c8ab499851e80016c4f_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-26_981b6b1905150c8ab499851e80016c4f_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
52KB

MD5
4005c1d535f6f6599498475b00b694e8

SHA1
58bdfd989c12c678bc3bc16def32a57692d99a36

SHA256
b6115c338e05160eaa24f471cac8274e8115e9f5dd4c56851f428658cee6aea8

SHA512
9a93ea0a3f3d2c555fc0e0ad004ea932d662a85356beb0cb32941acff8f543f8ac6f1f765252bffec02d708fcc9df2dc11818fb40c3230acc2bd38e4487dbced

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
52KB

MD5
4005c1d535f6f6599498475b00b694e8

SHA1
58bdfd989c12c678bc3bc16def32a57692d99a36

SHA256
b6115c338e05160eaa24f471cac8274e8115e9f5dd4c56851f428658cee6aea8

SHA512
9a93ea0a3f3d2c555fc0e0ad004ea932d662a85356beb0cb32941acff8f543f8ac6f1f765252bffec02d708fcc9df2dc11818fb40c3230acc2bd38e4487dbced

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
52KB

MD5
4005c1d535f6f6599498475b00b694e8

SHA1
58bdfd989c12c678bc3bc16def32a57692d99a36

SHA256
b6115c338e05160eaa24f471cac8274e8115e9f5dd4c56851f428658cee6aea8

SHA512
9a93ea0a3f3d2c555fc0e0ad004ea932d662a85356beb0cb32941acff8f543f8ac6f1f765252bffec02d708fcc9df2dc11818fb40c3230acc2bd38e4487dbced

Download Submit
memory/2688-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2688-19-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2688-18-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2688-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2768-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2768-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2768-3-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2768-2-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2768-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download