cfb8742fabf5768fdf36b0c4b43f7d161ace33a0d7af23541290e6929936b652

Analysis

max time kernel
181s
max time network
188s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 05:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-10_d06fb81901aa5ce653c2417feb00dd77_cryptolocker.exe
Size

38KB
MD5

d06fb81901aa5ce653c2417feb00dd77
SHA1

e8d6eb5e9c0319b53630f8d2025a10fe60bb7a29
SHA256

cfb8742fabf5768fdf36b0c4b43f7d161ace33a0d7af23541290e6929936b652
SHA512

fe54fac83dd291deb9e883f844779f738ddd2c1c07469274681a553d3df465de51dfaf85c24041643418ac95d1a528d2215b116b25dfbe64a0f99b35f19f1c7c
SSDEEP

768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvgpns:m5nkFNMOtEvwDpjG8hgps

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2576	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2716	2024-01-10_d06fb81901aa5ce653c2417feb00dd77_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2576	2716	2024-01-10_d06fb81901aa5ce653c2417feb00dd77_cryptolocker.exe	28
PID 2716 wrote to memory of 2576	2716	2024-01-10_d06fb81901aa5ce653c2417feb00dd77_cryptolocker.exe	28
PID 2716 wrote to memory of 2576	2716	2024-01-10_d06fb81901aa5ce653c2417feb00dd77_cryptolocker.exe	28
PID 2716 wrote to memory of 2576	2716	2024-01-10_d06fb81901aa5ce653c2417feb00dd77_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-10_d06fb81901aa5ce653c2417feb00dd77_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-10_d06fb81901aa5ce653c2417feb00dd77_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
38KB

MD5
653f0c2ce486ed9d42d1f3d115cb64c1

SHA1
9e0d1ad1b3510bfd3863cf4a5ef7b766ed2fd58b

SHA256
7ca620a96c557dbec1c4248a9e0566749cf5b9e1aa5abc54024512277a839fd0

SHA512
8c03736cd5157609357cd7fdde2e62354762d235a6574dc3aeccc11eabde5ea40f21d1800d996761be53237dfa9f6e99d8b0076ee23fa5e88d0dfb5eb5016c7c

Download Submit
memory/2576-17-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2576-19-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2576-26-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2716-1-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2716-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2716-3-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/2716-2-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2716-15-0x00000000025D0000-0x00000000025DE000-memory.dmp

Filesize
56KB

Download
memory/2716-14-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download