e0896bcd9c31a2a99407f7ae8f0601c6d035de501c074c8ebac11076c1b60059

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
06/11/2023, 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2023-09-28_6e562d07f07ac338f3773fc6babdfbd0_cryptolocker.exe
Size

75KB
MD5

6e562d07f07ac338f3773fc6babdfbd0
SHA1

fdb78a19b4bcaa817ef92c4c8af037a572053d22
SHA256

e0896bcd9c31a2a99407f7ae8f0601c6d035de501c074c8ebac11076c1b60059
SHA512

036d0f1ec996b9eada30d86ca58a2a7e44fb7ca90c34737054e42482b8f94cb2071f1db9012c831a78294589b9f3a1d5cc708f868102c741161c101ae12895bf
SSDEEP

1536:zj+soPSMOtEvwDpj4ktBl01hJ0tq1kyYAf:zCsanOtEvwDpjQ

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2956	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1272	NEAS.2023-09-28_6e562d07f07ac338f3773fc6babdfbd0_cryptolocker.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1272-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x000e00000001201d-11.dat	upx
behavioral1/memory/1272-15-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2956-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x000e00000001201d-14.dat	upx
behavioral1/files/0x000e00000001201d-25.dat	upx
behavioral1/memory/2956-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 2956	1272	NEAS.2023-09-28_6e562d07f07ac338f3773fc6babdfbd0_cryptolocker.exe	28
PID 1272 wrote to memory of 2956	1272	NEAS.2023-09-28_6e562d07f07ac338f3773fc6babdfbd0_cryptolocker.exe	28
PID 1272 wrote to memory of 2956	1272	NEAS.2023-09-28_6e562d07f07ac338f3773fc6babdfbd0_cryptolocker.exe	28
PID 1272 wrote to memory of 2956	1272	NEAS.2023-09-28_6e562d07f07ac338f3773fc6babdfbd0_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-28_6e562d07f07ac338f3773fc6babdfbd0_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-28_6e562d07f07ac338f3773fc6babdfbd0_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
75KB

MD5
5a95c42b3342278bfff71523b6fe7cd8

SHA1
e352d82a78dc6e728050a036bec809977a776797

SHA256
e5582820a55eca90f5ea4220f1bca380470d1dc3644070c7d0fe969c98072f9e

SHA512
89a560046cf12641676360ef4cfeeff7505eb96f5a4054b425491b779c805512370d0ae8dbc7a253215d25ff13348f44f9e332e09db8d466ab638249a54b520d

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
75KB

MD5
5a95c42b3342278bfff71523b6fe7cd8

SHA1
e352d82a78dc6e728050a036bec809977a776797

SHA256
e5582820a55eca90f5ea4220f1bca380470d1dc3644070c7d0fe969c98072f9e

SHA512
89a560046cf12641676360ef4cfeeff7505eb96f5a4054b425491b779c805512370d0ae8dbc7a253215d25ff13348f44f9e332e09db8d466ab638249a54b520d

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
75KB

MD5
5a95c42b3342278bfff71523b6fe7cd8

SHA1
e352d82a78dc6e728050a036bec809977a776797

SHA256
e5582820a55eca90f5ea4220f1bca380470d1dc3644070c7d0fe969c98072f9e

SHA512
89a560046cf12641676360ef4cfeeff7505eb96f5a4054b425491b779c805512370d0ae8dbc7a253215d25ff13348f44f9e332e09db8d466ab638249a54b520d

Download Submit
memory/1272-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1272-1-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/1272-3-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/1272-2-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/1272-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2956-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2956-19-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2956-18-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2956-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download