e80d845e3c390ef840ef1e97a512a757b93348ae05bc30abb97c9f5246aa496d

Analysis

max time kernel
0s
max time network
145s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-09_c8603cc0f9c5a65bd51e5e99eb4b047d_cryptolocker.exe
Size

62KB
MD5

c8603cc0f9c5a65bd51e5e99eb4b047d
SHA1

dedac7ef011b48562204d57bc444c7d4fb57a907
SHA256

e80d845e3c390ef840ef1e97a512a757b93348ae05bc30abb97c9f5246aa496d
SHA512

a6c85175cdc5e624a2d37ce04391b0e632d907c610daff79100e502c638e31f9150bc368a758a98604e3994a37e812ceae04f348680af4851b9f4d7ddba9fd24
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEpE05:6j+1NMOtEvwDpjr8ox8UDEp7

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2380	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2364	2024-01-09_c8603cc0f9c5a65bd51e5e99eb4b047d_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2380	2364	2024-01-09_c8603cc0f9c5a65bd51e5e99eb4b047d_cryptolocker.exe	16
PID 2364 wrote to memory of 2380	2364	2024-01-09_c8603cc0f9c5a65bd51e5e99eb4b047d_cryptolocker.exe	16
PID 2364 wrote to memory of 2380	2364	2024-01-09_c8603cc0f9c5a65bd51e5e99eb4b047d_cryptolocker.exe	16
PID 2364 wrote to memory of 2380	2364	2024-01-09_c8603cc0f9c5a65bd51e5e99eb4b047d_cryptolocker.exe	16

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
1⤵
- Executes dropped EXE
PID:2380

C:\Users\Admin\AppData\Local\Temp\2024-01-09_c8603cc0f9c5a65bd51e5e99eb4b047d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-09_c8603cc0f9c5a65bd51e5e99eb4b047d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
62KB

MD5
1fa2f3b7a5c7e9a288a3d074c82ffe14

SHA1
a0bfe8ca7bd97ff8c6be9a64b5843a825768f18b

SHA256
8ce403388f0c0d339510e9cc96113f990078940fa66e30fdc88e67199e35f6ad

SHA512
aaeabcba4668dac485765db4dc22492cd45b2f09a6b360d97746674b2544c3d6e8f5a27770beed2f55eed9b53f172aa79ea54162ae03031d47c16dcb3d0861fc

Download Submit
memory/2364-9-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2364-14-0x0000000000690000-0x000000000069F000-memory.dmp

Filesize
60KB

Download
memory/2364-8-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2364-1-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2364-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2364-26-0x0000000000690000-0x000000000069F000-memory.dmp

Filesize
60KB

Download
memory/2380-25-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2380-18-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2380-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2380-27-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download