f6286a5904a40384b4cd6c2b119aa8bb1ac3b26c86937cdc639967d714e734fb

Analysis

max time kernel
149s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 02:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f6286a5904a40384b4cd6c2b119aa8bb1ac3b26c86937cdc639967d714e734fb.exe
Size

53KB
MD5

a7ab51f8f01c68f99c9e3839eb2e5774
SHA1

620a25e26de0ac708321924c40468d5941111f95
SHA256

f6286a5904a40384b4cd6c2b119aa8bb1ac3b26c86937cdc639967d714e734fb
SHA512

58a72427d135ae9e53d72d38275d8c73be9713384d7241d3f723d0bf975b188d060db488f883e70ed1c6c8472a1cd77008bf83472d400dd03386dd372bcf5a3a
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdO5Yp:ZVxkGOtEvwDpjcY

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000800000001227d-11.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
1628	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2208	f6286a5904a40384b4cd6c2b119aa8bb1ac3b26c86937cdc639967d714e734fb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1628	2208	f6286a5904a40384b4cd6c2b119aa8bb1ac3b26c86937cdc639967d714e734fb.exe	28
PID 2208 wrote to memory of 1628	2208	f6286a5904a40384b4cd6c2b119aa8bb1ac3b26c86937cdc639967d714e734fb.exe	28
PID 2208 wrote to memory of 1628	2208	f6286a5904a40384b4cd6c2b119aa8bb1ac3b26c86937cdc639967d714e734fb.exe	28
PID 2208 wrote to memory of 1628	2208	f6286a5904a40384b4cd6c2b119aa8bb1ac3b26c86937cdc639967d714e734fb.exe	28

C:\Users\Admin\AppData\Local\Temp\f6286a5904a40384b4cd6c2b119aa8bb1ac3b26c86937cdc639967d714e734fb.exe
"C:\Users\Admin\AppData\Local\Temp\f6286a5904a40384b4cd6c2b119aa8bb1ac3b26c86937cdc639967d714e734fb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
53KB

MD5
025b01f82f78e33be8c93cab49b6b8b1

SHA1
ed36cb2241353c0f88c17a54c78e6f37e57b3885

SHA256
a260f89a405b2b854e3f64753a589004d4b0483b166bc36b369aea7b8a5a5bce

SHA512
5705293219a66fd40b559ad35d33967843908508290d42ff58a70406675f8e86baede6d332ed29630a85153adb2398304388738fd3517ceacf15ddc91026ff15

Download Submit
memory/1628-15-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1628-17-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2208-0-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2208-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2208-3-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2208-2-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download