d1c77c66e97f0a057a438b968edcbd73cb1cee46183d2fe7d70909c0e228fc75

Analysis

max time kernel
13s
max time network
184s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-01_9894d4e2ec69a06212db6c062e71a601_cryptolocker.exe
Size

39KB
MD5

9894d4e2ec69a06212db6c062e71a601
SHA1

bd2f15a9a3c505d1a2a3c9a31627a83dce224547
SHA256

d1c77c66e97f0a057a438b968edcbd73cb1cee46183d2fe7d70909c0e228fc75
SHA512

da9fc4559a07ddafdbdfd6cc52c163ed6c623bdf4842239a57b763f1e1cfcf37af1fbd6209ae980c6ef47d4cbc750883291c3a03ea323de28a7b6d9f08aab74a
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6nzhw:6j+1NMOtEvwDpjrRzi

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2276	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2340	2024-01-01_9894d4e2ec69a06212db6c062e71a601_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2276	2340	2024-01-01_9894d4e2ec69a06212db6c062e71a601_cryptolocker.exe	17
PID 2340 wrote to memory of 2276	2340	2024-01-01_9894d4e2ec69a06212db6c062e71a601_cryptolocker.exe	17
PID 2340 wrote to memory of 2276	2340	2024-01-01_9894d4e2ec69a06212db6c062e71a601_cryptolocker.exe	17
PID 2340 wrote to memory of 2276	2340	2024-01-01_9894d4e2ec69a06212db6c062e71a601_cryptolocker.exe	17

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
1⤵
- Executes dropped EXE
PID:2276

C:\Users\Admin\AppData\Local\Temp\2024-01-01_9894d4e2ec69a06212db6c062e71a601_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-01_9894d4e2ec69a06212db6c062e71a601_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
38KB

MD5
989494b66403c9b502d8603367083269

SHA1
b68859427ddcfea47999db1350494be1e4253de7

SHA256
faa53e6da98186c1c9067517b00a0c43d7b9fb2c9d08762d2f8f27a376d595c4

SHA512
d7a0c39a9ca4ae35e127bc7f77e92e0fe5a42cd496753867ebdeb3b098f786996e05600e2d43487bb63cf4684a56749a7173be1151152e645e9d83e7dce39ac3

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
24KB

MD5
07e7de456292bff899180569f6961e63

SHA1
b3055d708ec53cf2cdf07e407298f16b394df9ca

SHA256
0f940e6b604d9c987b7121b56ac1aa3b571c16acf0d847523fbfafa375730633

SHA512
fe0248c0fd9a6234fedfa5cf190556c0aaa2fc6f3acb2d22667fb1ecb999c923e62bca516812455c470bd92d0e6617e93f156fe296961b68f61d849a03b70dc5

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
1KB

MD5
f36b41fe438e721be3491ddc7e3a3697

SHA1
3996f1c8c612dc0959bbcbab5d4346616d993958

SHA256
698cfbdb818ece01e0ebce182008e24bdf14271427477e4f88deed166cb63a94

SHA512
9300d32e21831aa7a7b7b81a32a0de30476839d7b2686671280995126eacfa7649b859041a42fdb6718e31a45ebf314f481b50042753a361ad38b54b165738c5

Download Submit
memory/2276-26-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2276-19-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2276-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2276-27-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2340-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2340-13-0x0000000002700000-0x000000000270F000-memory.dmp

Filesize
60KB

Download
memory/2340-9-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2340-2-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/2340-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2340-1-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download