d6d51c3d54ee8c434c6e203ed30fbddc225a5a6995293106c313af77221cbae1

Analysis

max time kernel
146s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-10_b001593f3b5f997b7658ddef932ba1ad_cryptolocker.exe
Size

80KB
MD5

b001593f3b5f997b7658ddef932ba1ad
SHA1

0a2fe35d6c47f6e0eb0b3a1c624113b50f5a589f
SHA256

d6d51c3d54ee8c434c6e203ed30fbddc225a5a6995293106c313af77221cbae1
SHA512

affec2c21ea97b2c30b6c67a610386e9b35d5ffe39024f9c987c94bf757a1413320662549cc86ffe772931eb7a60ff8c0ee310678e27fbef087b87b6bcafb3ce
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfWafHNBD:vCjsIOtEvwDpj5H9YvQd27

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2704	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1736	2024-01-10_b001593f3b5f997b7658ddef932ba1ad_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2704	1736	2024-01-10_b001593f3b5f997b7658ddef932ba1ad_cryptolocker.exe	14
PID 1736 wrote to memory of 2704	1736	2024-01-10_b001593f3b5f997b7658ddef932ba1ad_cryptolocker.exe	14
PID 1736 wrote to memory of 2704	1736	2024-01-10_b001593f3b5f997b7658ddef932ba1ad_cryptolocker.exe	14
PID 1736 wrote to memory of 2704	1736	2024-01-10_b001593f3b5f997b7658ddef932ba1ad_cryptolocker.exe	14

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
1⤵
- Executes dropped EXE
PID:2704

C:\Users\Admin\AppData\Local\Temp\2024-01-10_b001593f3b5f997b7658ddef932ba1ad_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-10_b001593f3b5f997b7658ddef932ba1ad_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
81KB

MD5
9efce9bc471536a7042a1b986bbe46a7

SHA1
92225dc234fb5a451708887f57b9e070f198fcea

SHA256
9f203b0449f0aee5237a428d25f0ec6e263706b63ed2da5a2425220428cab08e

SHA512
8fad6af452ac2676854618b9bfff9de70862a4b440b3b615597010a8bb9ff993402263023d6e159fb33a12fea67daae966f19dd7df4b0a5734945857dd8cce04

Download Submit
memory/1736-8-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1736-1-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/1736-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2704-15-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2704-18-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download