885865cd1d6d7c5b6e0127884f52bf9388f2eb8cab41fe15fede4d631dcfdf28

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
04-11-2023 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2023-09-08_9a3121dadcdd609b1f9ae4555666f489_cryptolocker_JC.exe
Size

44KB
MD5

9a3121dadcdd609b1f9ae4555666f489
SHA1

70301f0e2dff767fe7898a1cc9ad59903b73e33e
SHA256

885865cd1d6d7c5b6e0127884f52bf9388f2eb8cab41fe15fede4d631dcfdf28
SHA512

c4ceb13d087303edb0b044c69552922cba27ee5e9f484d155b93103b8e30fd8f5e0ee6b96ba698f206d009308604eb3ebd62dc6c6946279edf501133e263d6d7
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrr46xdUUiu:vj+jsMQMOtEvwDpj5Hczer5iju

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2796	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1944	NEAS.2023-09-08_9a3121dadcdd609b1f9ae4555666f489_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2796	1944	NEAS.2023-09-08_9a3121dadcdd609b1f9ae4555666f489_cryptolocker_JC.exe	28
PID 1944 wrote to memory of 2796	1944	NEAS.2023-09-08_9a3121dadcdd609b1f9ae4555666f489_cryptolocker_JC.exe	28
PID 1944 wrote to memory of 2796	1944	NEAS.2023-09-08_9a3121dadcdd609b1f9ae4555666f489_cryptolocker_JC.exe	28
PID 1944 wrote to memory of 2796	1944	NEAS.2023-09-08_9a3121dadcdd609b1f9ae4555666f489_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_9a3121dadcdd609b1f9ae4555666f489_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_9a3121dadcdd609b1f9ae4555666f489_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
44KB

MD5
c86dfff4c617729bdd0f7d4c589fb3c6

SHA1
61fd33a3596c34c195607da847fe05a2c3146c8c

SHA256
0f7ad5e52a6595214afe5362baaad355b02b7392d611697a8d89211e272b62a1

SHA512
ec6a0e667803e31b234f6a561bee968a3b4b5436deb1a8489641aed498f3dbd2d89b82ad76013554e712e300762fb1409083219d4ddbef10bb25b48c8d84eae5

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
44KB

MD5
c86dfff4c617729bdd0f7d4c589fb3c6

SHA1
61fd33a3596c34c195607da847fe05a2c3146c8c

SHA256
0f7ad5e52a6595214afe5362baaad355b02b7392d611697a8d89211e272b62a1

SHA512
ec6a0e667803e31b234f6a561bee968a3b4b5436deb1a8489641aed498f3dbd2d89b82ad76013554e712e300762fb1409083219d4ddbef10bb25b48c8d84eae5

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
44KB

MD5
c86dfff4c617729bdd0f7d4c589fb3c6

SHA1
61fd33a3596c34c195607da847fe05a2c3146c8c

SHA256
0f7ad5e52a6595214afe5362baaad355b02b7392d611697a8d89211e272b62a1

SHA512
ec6a0e667803e31b234f6a561bee968a3b4b5436deb1a8489641aed498f3dbd2d89b82ad76013554e712e300762fb1409083219d4ddbef10bb25b48c8d84eae5

Download Submit
memory/1944-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1944-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1944-1-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2796-16-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2796-15-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download