c57a9f5a9ec8b19e661d8243d004995633a5ab9421bba2a936ae02dcc08ec364

Analysis

max time kernel
120s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-08_323a117e8b071016ddccc9bb2e37e304_cryptolocker.exe
Size

75KB
MD5

323a117e8b071016ddccc9bb2e37e304
SHA1

07e74cd2fffe952e69c1d8ac94bdaaaaeaa85cd2
SHA256

c57a9f5a9ec8b19e661d8243d004995633a5ab9421bba2a936ae02dcc08ec364
SHA512

0f5f0f7b9b2a8b77e36e29815693bd7a63224150c4bb04f37abf108cfa3e75487757dca33500d91083c36a6fa8ae6da57c77811f6b43f8a58468406bcb4baa92
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4U9HueDgaRWDtJgXkeUTn8Z4:vj+jsMQMOtEvwDpj5H8u8rLXkemng4

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2812	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2120	2024-01-08_323a117e8b071016ddccc9bb2e37e304_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2812	2120	2024-01-08_323a117e8b071016ddccc9bb2e37e304_cryptolocker.exe	18
PID 2120 wrote to memory of 2812	2120	2024-01-08_323a117e8b071016ddccc9bb2e37e304_cryptolocker.exe	18
PID 2120 wrote to memory of 2812	2120	2024-01-08_323a117e8b071016ddccc9bb2e37e304_cryptolocker.exe	18
PID 2120 wrote to memory of 2812	2120	2024-01-08_323a117e8b071016ddccc9bb2e37e304_cryptolocker.exe	18

C:\Users\Admin\AppData\Local\Temp\2024-01-08_323a117e8b071016ddccc9bb2e37e304_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-08_323a117e8b071016ddccc9bb2e37e304_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
75KB

MD5
d104dc0f600887d200869eb3cd01fda7

SHA1
849faf640b74ccd1f08bcd24e5a1480d9f28a328

SHA256
87b8f027b3fb66ac23c7cf04b694458978aa94356dabfcdb6770d41ac7b4ef86

SHA512
e7267ce1990a81f152323ee8c674ddb3712a312cdec818720f2a05c871abea50ed0a0445829094045063a343d437cc3afbad871d6e8c7ddfa99f559df212c77d

Download Submit
memory/2120-8-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2120-1-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2120-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2812-22-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2812-15-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download