f95a81f6f6cf3d90f284d3b03a3d60ff8ccb5672bbf68811187fd67828e0f0fa

Analysis

max time kernel
144s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-11_5679e8c0069a97b91a46ced439de7f40_cryptolocker.exe
Size

38KB
MD5

5679e8c0069a97b91a46ced439de7f40
SHA1

8ccf01b78fd5358aaa30382a14da9ef471e3189d
SHA256

f95a81f6f6cf3d90f284d3b03a3d60ff8ccb5672bbf68811187fd67828e0f0fa
SHA512

65af465550e7e377701e10a10dda2cd04ac9c5665a609f3bea36fcb6ad4a350c315059145b040036538f5f066d407150b54dff6c74a22269116e945f40a03b97
SSDEEP

768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvhx5/xFRd:m5nkFNMOtEvwDpjG8hhXP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2804	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1752	2024-01-11_5679e8c0069a97b91a46ced439de7f40_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2804	1752	2024-01-11_5679e8c0069a97b91a46ced439de7f40_cryptolocker.exe	16
PID 1752 wrote to memory of 2804	1752	2024-01-11_5679e8c0069a97b91a46ced439de7f40_cryptolocker.exe	16
PID 1752 wrote to memory of 2804	1752	2024-01-11_5679e8c0069a97b91a46ced439de7f40_cryptolocker.exe	16
PID 1752 wrote to memory of 2804	1752	2024-01-11_5679e8c0069a97b91a46ced439de7f40_cryptolocker.exe	16

C:\Users\Admin\AppData\Local\Temp\2024-01-11_5679e8c0069a97b91a46ced439de7f40_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-11_5679e8c0069a97b91a46ced439de7f40_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
13KB

MD5
6fd7f3d5dd0c556cd9e0f8a4a98786f2

SHA1
d704482528c762846b0492cbc97cd80dd4afa95a

SHA256
9915e10231eb04279aa0abc7f355e771feb42b1bb0cbe9f17eb7d5e878793ef3

SHA512
9018f9dcaefdc30e9721991820ecf82d7af7bfe4cde19e2ce9a48a7f90005cb5cfe4faebc64f266e95048bd7e0f4e64c99c91ae60f7442d29aba5bb30b0f77c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
38KB

MD5
e20ba6b0d421c29a6ce23c18c36c86e3

SHA1
4c9a7abfc5910fd0f2e6e2bd1c2bae5253acc56c

SHA256
bec1c4de535036ce951f7c22fbf3fb97459261b9c4e16971d532c1e3c0d61f1f

SHA512
8eec4d7141e1e1024c488c56552b8c1b220dcab7b1debdc4db9e32fdebd0d40ddcd07b7d82a14288f7f01e698113be04ccc130d65384d518d95f47728b7eea11

Download Submit
memory/1752-1-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/1752-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1752-12-0x00000000006D0000-0x00000000006DE000-memory.dmp

Filesize
56KB

Download
memory/1752-9-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1752-8-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2804-25-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2804-26-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2804-18-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download