d8f5dc5ec39f6a0dff8b155189d97157f9e30b8008fe7af8a5917312059767de

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 06:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-08_581f4821849faabe69416337bd0e3843_cryptolocker.exe
Size

120KB
MD5

581f4821849faabe69416337bd0e3843
SHA1

3356e5fd49b07037d78a6b80e83d8a4c5d7c5d15
SHA256

d8f5dc5ec39f6a0dff8b155189d97157f9e30b8008fe7af8a5917312059767de
SHA512

4f8d1a9519ca50b5c8cf496a70703bd6038896dcdeabdb4ff46ce930c2652479decb68f224e357a1a6fca50a42370de9657d474ab2a9fee96a8a6368b6cc437d
SSDEEP

768:gUQz7yVEhs9+4T/1bytOOtEvwDpjNbZ7uyA36S7MpxRIIXVe3mU9TYwlOBTZp:gUj+AIMOtEvwDpjNbwQEIPlemUhYpp

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2108	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2164	2024-01-08_581f4821849faabe69416337bd0e3843_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2108	2164	2024-01-08_581f4821849faabe69416337bd0e3843_cryptolocker.exe	28
PID 2164 wrote to memory of 2108	2164	2024-01-08_581f4821849faabe69416337bd0e3843_cryptolocker.exe	28
PID 2164 wrote to memory of 2108	2164	2024-01-08_581f4821849faabe69416337bd0e3843_cryptolocker.exe	28
PID 2164 wrote to memory of 2108	2164	2024-01-08_581f4821849faabe69416337bd0e3843_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-08_581f4821849faabe69416337bd0e3843_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-08_581f4821849faabe69416337bd0e3843_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
120KB

MD5
0b621413e6d0a05b8383368036ccbea6

SHA1
fceee9b300597a9e2544b7666cff8c80a9cb52a6

SHA256
941ef817bb6879bb64b00359c54eb1200802c6e70cc544c4d350e2684d12f78b

SHA512
1891a9d84d1d287193250820e5e351f2c3fc3f1c2726350473d17fcbc72464b50167d386294e2a08b97e08bdf481fa03c8544789fadfa98c1923fac514e6e0d4

Download Submit
memory/2108-15-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2108-20-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2164-0-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2164-1-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2164-3-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download