4ca04a9e34f3b1bf31d91a38ff8928b00ed2382a1060edb878f0becf4b826e2a

Analysis

max time kernel
150s
max time network
159s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-11_0c90ae004707161f206ef17f163ec641_cryptolocker.exe
Size

39KB
MD5

0c90ae004707161f206ef17f163ec641
SHA1

d0b9b583bde6fefd1d57553e2aa52b3b95124483
SHA256

4ca04a9e34f3b1bf31d91a38ff8928b00ed2382a1060edb878f0becf4b826e2a
SHA512

2f30ae98b6041924cd6a7ecb92f2fd1a728843e470a1afa9ebc5a7bcff4480f1566ce622f2f49c6419ae6a62bb500982673f5ede006d06ca4835e75fbe8d513f
SSDEEP

768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvgpnGtg:m5nkFNMOtEvwDpjG8hgpx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2304	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1904	2024-01-11_0c90ae004707161f206ef17f163ec641_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2304	1904	2024-01-11_0c90ae004707161f206ef17f163ec641_cryptolocker.exe	27
PID 1904 wrote to memory of 2304	1904	2024-01-11_0c90ae004707161f206ef17f163ec641_cryptolocker.exe	27
PID 1904 wrote to memory of 2304	1904	2024-01-11_0c90ae004707161f206ef17f163ec641_cryptolocker.exe	27
PID 1904 wrote to memory of 2304	1904	2024-01-11_0c90ae004707161f206ef17f163ec641_cryptolocker.exe	27

C:\Users\Admin\AppData\Local\Temp\2024-01-11_0c90ae004707161f206ef17f163ec641_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-11_0c90ae004707161f206ef17f163ec641_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
39KB

MD5
95f15ef585e1e3e397a23fc87cc73ee1

SHA1
37a1230572e90740392a86d0d1f8df2bca4b6146

SHA256
6512011a93a9a014c5e1d29354e401227050c5db3c15fca499a68f98035ce2ce

SHA512
b7b8af3d1d66efea44468672678b3fda9ce8d2f0338374aeb1dc88a6a733f64eac0c99f31fdaa8f1d8692941a706703defeda83afd92c350a9d0d918f477c314

Download Submit
memory/1904-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/1904-2-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/1904-1-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/1904-8-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/1904-15-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/1904-13-0x00000000025C0000-0x00000000025CE000-memory.dmp

Filesize
56KB

Download
memory/2304-17-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2304-19-0x0000000000260000-0x0000000000266000-memory.dmp

Filesize
24KB

Download
memory/2304-25-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2304-27-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download