cbece3b3d9a800bb9ec19025a85549e70d0a788e8d78c263544f754f5c7eec1c

Analysis

max time kernel
0s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-09_ef678a12fcf2b0f30b25dc3a74cfcd9b_cryptolocker.exe
Size

72KB
MD5

ef678a12fcf2b0f30b25dc3a74cfcd9b
SHA1

81de6b93ad77f3b858aac83326b40b089a528a2b
SHA256

cbece3b3d9a800bb9ec19025a85549e70d0a788e8d78c263544f754f5c7eec1c
SHA512

e3bd05163b2f70d238f48df8da9fba7c5702b88496c0d28f6e7a6dc7311a2590fd248195118d8c6f6f9bd42ee9ebbe0105e28597fe54d7e41392edac9208d162
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ3KK:ZVxkGOtEvwDpjcaZ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3060	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2156	2024-01-09_ef678a12fcf2b0f30b25dc3a74cfcd9b_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 3060	2156	2024-01-09_ef678a12fcf2b0f30b25dc3a74cfcd9b_cryptolocker.exe	14
PID 2156 wrote to memory of 3060	2156	2024-01-09_ef678a12fcf2b0f30b25dc3a74cfcd9b_cryptolocker.exe	14
PID 2156 wrote to memory of 3060	2156	2024-01-09_ef678a12fcf2b0f30b25dc3a74cfcd9b_cryptolocker.exe	14
PID 2156 wrote to memory of 3060	2156	2024-01-09_ef678a12fcf2b0f30b25dc3a74cfcd9b_cryptolocker.exe	14

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
1⤵
- Executes dropped EXE
PID:3060

C:\Users\Admin\AppData\Local\Temp\2024-01-09_ef678a12fcf2b0f30b25dc3a74cfcd9b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-09_ef678a12fcf2b0f30b25dc3a74cfcd9b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
23KB

MD5
2450279ba05260cc87f2f85bb18234d2

SHA1
fc335aca83e94b56bbbb2f6649a761f94dbe5b74

SHA256
5a225c48111f6fc69c5b16746b8a2f4fc324aa15f3e88651911f166dacde27ce

SHA512
f4a95aee3e5b1a8dff5509139a602909409ab7fe5d5a330a63348cd6ec380ac5a7f914feb4bb65b416588225a4a394b3376e06d564f45a2fd8d4f83ea24b86e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
9KB

MD5
a9b462a2fb7403313f4dfbf6c2ed2fee

SHA1
ed276ab9b46b3521c77a53ea2de9d3fe2c0afb30

SHA256
a5f055edb10e76f1ff87cbb47cb794963996518a3e767ccc4fd5607a275de193

SHA512
10dc6483049206684ebe233c4a91b0ea64502180e8a09c56a8e69e66ac41ec759318980ce7f90ed137c8cce0ade901cec8fd5a3ddd53d69aa64427ae6d14846f

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
54KB

MD5
7959b4a01963bb045debd8fa5391f3a6

SHA1
7a91ab261811bec72a025ea027860bf884743f98

SHA256
ed348dbf2e61f4b58ae99235b1d5f0798585d2466a5fb86245bd165e76d0cfab

SHA512
f378386458afb00caaf3edcec01116760b09ee2456647fc7a2d4d1d7ddea52cceff140e28090272f02974ce9e18ee51fff005a42eadcc88ebd13f2549dd0a495

Download Submit
memory/2156-9-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2156-8-0x00000000003B0000-0x00000000003F0000-memory.dmp

Filesize
256KB

Download
memory/2156-1-0x00000000020B0000-0x00000000020B6000-memory.dmp

Filesize
24KB

Download
memory/2156-0-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/3060-23-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/3060-16-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download