352ad97b32d272e4dd698e35a4d8f224e40561d0bde675a87d31833fc25d433e

Analysis

max time kernel
141s
max time network
155s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 05:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-09_aa368d6f7318d1e3134ab05e4f806dde_cryptolocker.exe
Size

39KB
MD5

aa368d6f7318d1e3134ab05e4f806dde
SHA1

ca5337fcec2b77f58a67cc48338fda1b111a6beb
SHA256

352ad97b32d272e4dd698e35a4d8f224e40561d0bde675a87d31833fc25d433e
SHA512

8ab434bb17f162b85d48982b67610af22b1ca14fd3cc6a99c1f134f4eaa34548378d6ad5a091a8675a7ee2d93f3d800b93056d92ae3ea20364e2146c277ad959
SSDEEP

384:60VkMq01bJ3wtEwPS8HLEh+Jagz+3be+26aIIcVRYpetOOtEvwDpjqIGRmdHzOO7:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/p

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2296	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
852	2024-01-09_aa368d6f7318d1e3134ab05e4f806dde_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 2296	852	2024-01-09_aa368d6f7318d1e3134ab05e4f806dde_cryptolocker.exe	16
PID 852 wrote to memory of 2296	852	2024-01-09_aa368d6f7318d1e3134ab05e4f806dde_cryptolocker.exe	16
PID 852 wrote to memory of 2296	852	2024-01-09_aa368d6f7318d1e3134ab05e4f806dde_cryptolocker.exe	16
PID 852 wrote to memory of 2296	852	2024-01-09_aa368d6f7318d1e3134ab05e4f806dde_cryptolocker.exe	16

C:\Users\Admin\AppData\Local\Temp\2024-01-09_aa368d6f7318d1e3134ab05e4f806dde_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-09_aa368d6f7318d1e3134ab05e4f806dde_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:852
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
39KB

MD5
f157a40f450e074703d4cccb4e6eb1b9

SHA1
e98461bfe34fd312be2fc07ab30e0fe607a492f8

SHA256
b3c01d4a877860e64b85b374719a2313b19b470d02ef0c61a6c5850d4a326298

SHA512
6ebd9c721bd96e7a36e01a87cfb3d9a483a35cfd9b8a2a78070382af7114dcc6af98280d0c1f0a5decf666049dd0e5bca47b54cdfbabe873b721fc716b7fe99a

Download Submit
memory/852-1-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/852-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/852-3-0x00000000002E0000-0x00000000002E6000-memory.dmp

Filesize
24KB

Download
memory/852-2-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/852-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2296-25-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2296-18-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2296-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2296-26-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download