f36ae84ab6760e473beb26856a536792a9a12047fc85b8b8a78ae4ff100b4670

Analysis

max time kernel
150s
max time network
169s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 06:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-08_ef2384e8ee28a565732058be8ffb8831_cryptolocker.exe
Size

60KB
MD5

ef2384e8ee28a565732058be8ffb8831
SHA1

4392fb6f7fd51adb63018b75f6429e207b7df53a
SHA256

f36ae84ab6760e473beb26856a536792a9a12047fc85b8b8a78ae4ff100b4670
SHA512

70a9b96b2a25e72b6a638a45b0fb0d44a5a8113df0375e85bbc56e7e88c413e7a856fb5866bc25c18f6fc1d8eef325a376ea43eb72225cd4335e443ca17dafc3
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEpE9:6j+1NMOtEvwDpjr8ox8UDEpq

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2708	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1512	2024-01-08_ef2384e8ee28a565732058be8ffb8831_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 2708	1512	2024-01-08_ef2384e8ee28a565732058be8ffb8831_cryptolocker.exe	28
PID 1512 wrote to memory of 2708	1512	2024-01-08_ef2384e8ee28a565732058be8ffb8831_cryptolocker.exe	28
PID 1512 wrote to memory of 2708	1512	2024-01-08_ef2384e8ee28a565732058be8ffb8831_cryptolocker.exe	28
PID 1512 wrote to memory of 2708	1512	2024-01-08_ef2384e8ee28a565732058be8ffb8831_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-08_ef2384e8ee28a565732058be8ffb8831_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-08_ef2384e8ee28a565732058be8ffb8831_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
60KB

MD5
4149da9a0280d5b06a00a093e478e7dd

SHA1
4ef09fbb81bbc7e6b0e9530d1339a07f4b384b95

SHA256
9cc73c19d517b258f488e8c9d57962551a744243022a0e3fd1851dd7058e2eae

SHA512
ca6208761bc04a5b7bf8c2bafded9088985e09cf199490b7f327c2ae424f4b0fa2eda61ae7c4d8200cf543f3e70c54acd37c40b9da1de3822d19da7021e29250

Download Submit
memory/1512-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1512-2-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/1512-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1512-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1512-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1512-15-0x00000000006F0000-0x00000000006FF000-memory.dmp

Filesize
60KB

Download
memory/2708-22-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2708-19-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2708-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2708-27-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download