a7313f0aaae9996b06725f35437721d0e9095e57a01aa38d04a0db54bc901b41

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-09_8360b48378cfcb7fba3bcaf95efa3062_cryptolocker.exe
Size

59KB
MD5

8360b48378cfcb7fba3bcaf95efa3062
SHA1

0f71591b9ee78dfa7ba364f9eae9b7b72e1fb8f5
SHA256

a7313f0aaae9996b06725f35437721d0e9095e57a01aa38d04a0db54bc901b41
SHA512

659d215026bf51eabc5a16b2db23fcac2baa71887f2cbf4173cb18491ddac5280d59371b352a7abc0c65754c5a8ec522dbec39625a2a8a4ef7404f28956b6fac
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMH:TCjsIOtEvwDpj5HE/OUHnSMI

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2888	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2300	2024-01-09_8360b48378cfcb7fba3bcaf95efa3062_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2888	2300	2024-01-09_8360b48378cfcb7fba3bcaf95efa3062_cryptolocker.exe	14
PID 2300 wrote to memory of 2888	2300	2024-01-09_8360b48378cfcb7fba3bcaf95efa3062_cryptolocker.exe	14
PID 2300 wrote to memory of 2888	2300	2024-01-09_8360b48378cfcb7fba3bcaf95efa3062_cryptolocker.exe	14
PID 2300 wrote to memory of 2888	2300	2024-01-09_8360b48378cfcb7fba3bcaf95efa3062_cryptolocker.exe	14

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
1⤵
- Executes dropped EXE
PID:2888

C:\Users\Admin\AppData\Local\Temp\2024-01-09_8360b48378cfcb7fba3bcaf95efa3062_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-09_8360b48378cfcb7fba3bcaf95efa3062_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
59KB

MD5
9c19d2e80c201a066a1563febef94702

SHA1
ba3b873ea9bea85b5a74b42445620e16b5240a94

SHA256
518158d6daaa2647b487737034435e81f146ae383cee3d783eeddfe89908c396

SHA512
e9ba0d0d4b8ab40d6c95cb980891115f34adcd703412cfd0d96e4ed327409bfdd8d8387fcc463616f5b74079f723cfeda959540312a5c85c70ba0ab49454a224

Download Submit
memory/2300-9-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2300-8-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2300-1-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2300-0-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2888-16-0x0000000000530000-0x0000000000536000-memory.dmp

Filesize
24KB

Download
memory/2888-22-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download