d57a00ea28651fc99e22c1905cbcad5325af4bb2a0a50a46b85cb7f050d7deeb

Analysis

max time kernel
168s
max time network
180s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 05:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-09_7c4953f83032797e4a913df7cf376e6a_cryptolocker.exe
Size

74KB
MD5

7c4953f83032797e4a913df7cf376e6a
SHA1

82804b2358136eda36f84de93cd752262657910b
SHA256

d57a00ea28651fc99e22c1905cbcad5325af4bb2a0a50a46b85cb7f050d7deeb
SHA512

8adc33ea9457efae762e6e94988b7a688f078aa3627412a16c91a44a2fbc528b95e6ac822ebb4859410b733c4ed28a5e546ae9a009f87df7594495d211d7e875
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ3Kr:ZVxkGOtEvwDpjca8

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2728	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2816	2024-01-09_7c4953f83032797e4a913df7cf376e6a_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2728	2816	2024-01-09_7c4953f83032797e4a913df7cf376e6a_cryptolocker.exe	29
PID 2816 wrote to memory of 2728	2816	2024-01-09_7c4953f83032797e4a913df7cf376e6a_cryptolocker.exe	29
PID 2816 wrote to memory of 2728	2816	2024-01-09_7c4953f83032797e4a913df7cf376e6a_cryptolocker.exe	29
PID 2816 wrote to memory of 2728	2816	2024-01-09_7c4953f83032797e4a913df7cf376e6a_cryptolocker.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-01-09_7c4953f83032797e4a913df7cf376e6a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-09_7c4953f83032797e4a913df7cf376e6a_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
74KB

MD5
4f31187fe8be0d739efa6ba65063947e

SHA1
2f3ce0b0e1e2ad434bd9cf991b2c6ee38a3db1a3

SHA256
db494046f187ed0b04969ff831aeb6cda43460141c7a7fb8f607ee2c85152ff6

SHA512
a72c65eefb9c8e4eaa745b24bf9d3c6947318450ef6cccccd60e5bc546109c3ee2f13b7a505326211e753903df5ea53f073a21a8c42179f974ef1da8b828beb6

Download Submit
memory/2728-22-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2728-15-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/2816-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2816-2-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2816-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download