ce0c128d0dbd32f87f97c6e49e5c2605f30c8fdb797fc24d98e9d4d6ffdbcfa0

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-06_9ba8aeeedbccc4ccb55cb3e156a2f81f_cryptolocker.exe
Size

119KB
MD5

9ba8aeeedbccc4ccb55cb3e156a2f81f
SHA1

a2552218ccf6ea181d10162c95770b73c06d37a3
SHA256

ce0c128d0dbd32f87f97c6e49e5c2605f30c8fdb797fc24d98e9d4d6ffdbcfa0
SHA512

21a627bc369fcec647eff78830fdf072445b1416668e4fae4fa4f68afe2108b7a1b56805db9b583a9580bb63ea4072172a42c99cad9ca0c6094fe4e05d7b7940
SSDEEP

768:gUQz7yVEhs9+4T/1bytOOtEvwDpjNbZ7uyA36S7MpxRIIXVe3mU9TYwlOBTZuNlu:gUj+AIMOtEvwDpjNbwQEIPlemUhYpqI

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1812	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2928	2024-01-06_9ba8aeeedbccc4ccb55cb3e156a2f81f_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 1812	2928	2024-01-06_9ba8aeeedbccc4ccb55cb3e156a2f81f_cryptolocker.exe	28
PID 2928 wrote to memory of 1812	2928	2024-01-06_9ba8aeeedbccc4ccb55cb3e156a2f81f_cryptolocker.exe	28
PID 2928 wrote to memory of 1812	2928	2024-01-06_9ba8aeeedbccc4ccb55cb3e156a2f81f_cryptolocker.exe	28
PID 2928 wrote to memory of 1812	2928	2024-01-06_9ba8aeeedbccc4ccb55cb3e156a2f81f_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-06_9ba8aeeedbccc4ccb55cb3e156a2f81f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-06_9ba8aeeedbccc4ccb55cb3e156a2f81f_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
120KB

MD5
ace1c4802f8d7e96e22712a2e536d150

SHA1
7795ebff11112e5c5733ccceb98a0be509647f53

SHA256
f20d68fdba36d6a1404d33a442c6621946822bb733ba2983c2a977614762e815

SHA512
d5e30deac0e9f99974837ba6a7ee73c88adf6002cda2781724fa033c8c72ab46555f264799ba9212083736e3585f6ca96202c2c1581569beb01186f676df965a

Download Submit
memory/1812-16-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1812-15-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2928-0-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2928-1-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2928-7-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download