ee37e169f9e35aee337de2471b1fbb57bf83654330854896001bed76210c64e7

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
31/10/2023, 21:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2023-09-05_827cd6179e9a6c20a25141afe0cd39f3_cryptolocker_JC.exe
Size

66KB
MD5

827cd6179e9a6c20a25141afe0cd39f3
SHA1

84f325c7e9922fcc82938ca5a1ed8eab55131a5e
SHA256

ee37e169f9e35aee337de2471b1fbb57bf83654330854896001bed76210c64e7
SHA512

6f1a4723f329baeffc9821c81d3c21d2101d5530156348d3a76a55409a5f347499dbab1020132efea4f01a9a68e83f52a81492d6336c8829b3d14a8b53e16026
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4ZPsED3VK2+ZtyOjgO4r9vFAg2rq2g1B/RQ:vj+jsMQMOtEvwDpj5HZYTjipvF24I

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2012	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2096	NEAS.2023-09-05_827cd6179e9a6c20a25141afe0cd39f3_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2012	2096	NEAS.2023-09-05_827cd6179e9a6c20a25141afe0cd39f3_cryptolocker_JC.exe	28
PID 2096 wrote to memory of 2012	2096	NEAS.2023-09-05_827cd6179e9a6c20a25141afe0cd39f3_cryptolocker_JC.exe	28
PID 2096 wrote to memory of 2012	2096	NEAS.2023-09-05_827cd6179e9a6c20a25141afe0cd39f3_cryptolocker_JC.exe	28
PID 2096 wrote to memory of 2012	2096	NEAS.2023-09-05_827cd6179e9a6c20a25141afe0cd39f3_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_827cd6179e9a6c20a25141afe0cd39f3_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_827cd6179e9a6c20a25141afe0cd39f3_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
66KB

MD5
3d109ae3cb0c8ae1f403d3ecdc8d426d

SHA1
9e32f3e983f6a10dcf0137d049177eb973e176a1

SHA256
341b70c4306a55a6a499208aea9c118b5651a04b5d626d103f7e8703b6c2ea71

SHA512
436cb6cccd08528e6f6795a3b2f089ffc1aa3e200a6f37b82c6d4ebe3b4bd06ba9d0cf8fedc79a723f8d854502f9e3990a9be16bc8290b31b94e0a5f8dd47b44

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
66KB

MD5
3d109ae3cb0c8ae1f403d3ecdc8d426d

SHA1
9e32f3e983f6a10dcf0137d049177eb973e176a1

SHA256
341b70c4306a55a6a499208aea9c118b5651a04b5d626d103f7e8703b6c2ea71

SHA512
436cb6cccd08528e6f6795a3b2f089ffc1aa3e200a6f37b82c6d4ebe3b4bd06ba9d0cf8fedc79a723f8d854502f9e3990a9be16bc8290b31b94e0a5f8dd47b44

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
66KB

MD5
3d109ae3cb0c8ae1f403d3ecdc8d426d

SHA1
9e32f3e983f6a10dcf0137d049177eb973e176a1

SHA256
341b70c4306a55a6a499208aea9c118b5651a04b5d626d103f7e8703b6c2ea71

SHA512
436cb6cccd08528e6f6795a3b2f089ffc1aa3e200a6f37b82c6d4ebe3b4bd06ba9d0cf8fedc79a723f8d854502f9e3990a9be16bc8290b31b94e0a5f8dd47b44

Download Submit
memory/2012-15-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2012-16-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2096-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2096-1-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/2096-3-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download