b3c071938b68fadb07b64b0b96eb9b8fff3347139f25fb770a12f15c299be08e

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
23-10-2023 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2023-09-05_295fca4e1e43eb635a7a543b158c2e99_cryptolocker_JC.exe
Size

53KB
MD5

295fca4e1e43eb635a7a543b158c2e99
SHA1

5c3992e9abc5dd70da5417f962c16cfabc27d62f
SHA256

b3c071938b68fadb07b64b0b96eb9b8fff3347139f25fb770a12f15c299be08e
SHA512

ca214314fbc39bfb44bfb520b2d681b777c6ed59787ba71bf61ee863604f9bff02f9bf06e8baa1fc51b2e68b45726106eb60ec2e92d2a88e899f636fafb726e3
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZgBh8i6g7Gok:xj+VGMOtEvwDpjubEgh

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2400	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2032	NEAS.2023-09-05_295fca4e1e43eb635a7a543b158c2e99_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2400	2032	NEAS.2023-09-05_295fca4e1e43eb635a7a543b158c2e99_cryptolocker_JC.exe	28
PID 2032 wrote to memory of 2400	2032	NEAS.2023-09-05_295fca4e1e43eb635a7a543b158c2e99_cryptolocker_JC.exe	28
PID 2032 wrote to memory of 2400	2032	NEAS.2023-09-05_295fca4e1e43eb635a7a543b158c2e99_cryptolocker_JC.exe	28
PID 2032 wrote to memory of 2400	2032	NEAS.2023-09-05_295fca4e1e43eb635a7a543b158c2e99_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_295fca4e1e43eb635a7a543b158c2e99_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_295fca4e1e43eb635a7a543b158c2e99_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
53KB

MD5
924a1b5fa5832d92e818740b2a00ce76

SHA1
c46a8c440f98f224589d877e98a2a08a31cc9e9e

SHA256
ab6dc96b0836b0f8b313b2a13a3e78c77c781c4cdc8c3067eb1b422525fc5b49

SHA512
b0d1d5fe47a70d92b1cf71d4e9fbadefd76cb7b55c995ef6a1099b8321b2374c204db32de6dfcda56cc6d3ad8229a38c0861e8410d24f32d41b62c4b0a563565

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
53KB

MD5
924a1b5fa5832d92e818740b2a00ce76

SHA1
c46a8c440f98f224589d877e98a2a08a31cc9e9e

SHA256
ab6dc96b0836b0f8b313b2a13a3e78c77c781c4cdc8c3067eb1b422525fc5b49

SHA512
b0d1d5fe47a70d92b1cf71d4e9fbadefd76cb7b55c995ef6a1099b8321b2374c204db32de6dfcda56cc6d3ad8229a38c0861e8410d24f32d41b62c4b0a563565

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
53KB

MD5
924a1b5fa5832d92e818740b2a00ce76

SHA1
c46a8c440f98f224589d877e98a2a08a31cc9e9e

SHA256
ab6dc96b0836b0f8b313b2a13a3e78c77c781c4cdc8c3067eb1b422525fc5b49

SHA512
b0d1d5fe47a70d92b1cf71d4e9fbadefd76cb7b55c995ef6a1099b8321b2374c204db32de6dfcda56cc6d3ad8229a38c0861e8410d24f32d41b62c4b0a563565

Download Submit
memory/2032-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2032-1-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2032-3-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2032-2-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2032-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2400-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2400-19-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2400-18-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2400-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download