48aed692a9c45436e945439e55ad61c5c00bad56fad43232074e054ffbe85bcb

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48aed692a9c45436e945439e55ad61c5c00bad56fad43232074e054ffbe85bcb.exe
Size

40KB
MD5

365636c467c478d5f8bd750b4f54fa25
SHA1

26cf7852f8a51e2dcab9760a72c1e92def5752a1
SHA256

48aed692a9c45436e945439e55ad61c5c00bad56fad43232074e054ffbe85bcb
SHA512

8baa9001c576bc1050c0c7bf8dea7471b98829e77ae6d975b5f08c70d45dd2aee6cb72fea63ce987f71ea956f880f65051caab9e4a56ec04589cadd184b0dbb9
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLeJAsKuD+/:ZzFbxmLPWQMOtEvwDpjLeJAsKcm

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000014fe1-11.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2816	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2804	48aed692a9c45436e945439e55ad61c5c00bad56fad43232074e054ffbe85bcb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2816	2804	48aed692a9c45436e945439e55ad61c5c00bad56fad43232074e054ffbe85bcb.exe	28
PID 2804 wrote to memory of 2816	2804	48aed692a9c45436e945439e55ad61c5c00bad56fad43232074e054ffbe85bcb.exe	28
PID 2804 wrote to memory of 2816	2804	48aed692a9c45436e945439e55ad61c5c00bad56fad43232074e054ffbe85bcb.exe	28
PID 2804 wrote to memory of 2816	2804	48aed692a9c45436e945439e55ad61c5c00bad56fad43232074e054ffbe85bcb.exe	28

C:\Users\Admin\AppData\Local\Temp\48aed692a9c45436e945439e55ad61c5c00bad56fad43232074e054ffbe85bcb.exe
"C:\Users\Admin\AppData\Local\Temp\48aed692a9c45436e945439e55ad61c5c00bad56fad43232074e054ffbe85bcb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
40KB

MD5
1b0f53ac4439be297ffb93ea9424ea5c

SHA1
c02b0651956239cb8a78b8abdd5bacc17d32c13b

SHA256
d69fb46b922693db98085f635814ed3c94172d03c03811d35596bbe98b35c754

SHA512
f1f884aa1f9a252156bce6dc8c5cb2c0960ebf7c856068bf6f2bef4cd94d8d4a6a5411b62727467b68e4a0a3edc2f775dad906724845497150dc1d107b6b237d

Download Submit
memory/2804-0-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2804-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2804-2-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2804-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2816-15-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2816-17-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2816-24-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download