539ac729c9153b9572bd2f08eac3ca707fafc88e64df7e4330b7452c0bb9ee35

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05-01-2024 05:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-01_22be022e24f27d436677a939b4eaadb6_cryptolocker.exe
Size

58KB
MD5

22be022e24f27d436677a939b4eaadb6
SHA1

72c9e0e87de4f0b24b10674a6237390572d53709
SHA256

539ac729c9153b9572bd2f08eac3ca707fafc88e64df7e4330b7452c0bb9ee35
SHA512

3cc3e5c60b8fadf945c41971faf2df2283a88504b04b47e0bbdc8696570b92f5e4d6e876cdda6ab7c1452af11ce79723d24b45599142fd6c30215d3efb6c3473
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMT7t:TCjsIOtEvwDpj5HE/OUHnSMG

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2480	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2916	2024-01-01_22be022e24f27d436677a939b4eaadb6_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2480	2916	2024-01-01_22be022e24f27d436677a939b4eaadb6_cryptolocker.exe	17
PID 2916 wrote to memory of 2480	2916	2024-01-01_22be022e24f27d436677a939b4eaadb6_cryptolocker.exe	17
PID 2916 wrote to memory of 2480	2916	2024-01-01_22be022e24f27d436677a939b4eaadb6_cryptolocker.exe	17
PID 2916 wrote to memory of 2480	2916	2024-01-01_22be022e24f27d436677a939b4eaadb6_cryptolocker.exe	17

C:\Users\Admin\AppData\Local\Temp\2024-01-01_22be022e24f27d436677a939b4eaadb6_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-01_22be022e24f27d436677a939b4eaadb6_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
48KB

MD5
def9517fbf5f5f34dd764616c1a63bf9

SHA1
ca1aa51f01f63642c1eff6d916d4179659bef60f

SHA256
5a735b714b75cfe2569432dbc848b3d364448f13a39e5d5759fb087377f23fae

SHA512
ed0178398fd039c946c2adc9f5c0b851f57c936701ca51de6b486aac1cab115ba0cf301ec041d455196ebe4efe1adac2d86a271b078737fa8ecc006ea7d7c5e4

Download Submit
memory/2480-18-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2916-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2916-3-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2916-2-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2916-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2916-14-0x00000000006B0000-0x00000000006BE000-memory.dmp

Filesize
56KB

Download
memory/2916-15-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download