c3f0b683179961a010bc3e572f1869e78b01b5a177a342cd010bf292f3e25fda

Analysis

max time kernel
139s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-09_fc3d550baf611f50ab6f9f641a3d7055_cryptolocker.exe
Size

121KB
MD5

fc3d550baf611f50ab6f9f641a3d7055
SHA1

7b2f202b21b219fa6d5e2277a3f6f788c50be148
SHA256

c3f0b683179961a010bc3e572f1869e78b01b5a177a342cd010bf292f3e25fda
SHA512

3a285062f89188ee727bb16c831b963e06ed63c6ae5999561fabc41a019548e01c6f934b015a98d23d199f031dcd15c9b10cad739dcdb0ca88c43221b35fabde
SSDEEP

768:gUQz7yVEhs9+4T/1bytOOtEvwDpjNbZ7uyA36S7MpxRIIXVe3mU9TYwlOBTZEi:gUj+AIMOtEvwDpjNbwQEIPlemUhYpEi

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2276	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2640	2024-01-09_fc3d550baf611f50ab6f9f641a3d7055_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2276	2640	2024-01-09_fc3d550baf611f50ab6f9f641a3d7055_cryptolocker.exe	28
PID 2640 wrote to memory of 2276	2640	2024-01-09_fc3d550baf611f50ab6f9f641a3d7055_cryptolocker.exe	28
PID 2640 wrote to memory of 2276	2640	2024-01-09_fc3d550baf611f50ab6f9f641a3d7055_cryptolocker.exe	28
PID 2640 wrote to memory of 2276	2640	2024-01-09_fc3d550baf611f50ab6f9f641a3d7055_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-09_fc3d550baf611f50ab6f9f641a3d7055_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-09_fc3d550baf611f50ab6f9f641a3d7055_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
121KB

MD5
9c66672d23f4b411e2cc80cd26d065f0

SHA1
54a096639b695515707b9e9c8e15dd5649e042d9

SHA256
a5de33acbcfd4351b3c05333b9437b8d91a52cd6d5804e2ac299310dac4ce9f3

SHA512
5862863cbf92db39ffc0aa945117a52319ccd6e1d36dd824f3af53077776201605797f160be817ba9a91fb59169044339452637b559914433d1612f32998ac83

Download Submit
memory/2276-15-0x00000000002E0000-0x00000000002E6000-memory.dmp

Filesize
24KB

Download
memory/2276-16-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2640-0-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2640-1-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2640-3-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download