1047deaf786ef82a4b493c18d47f8ebc263af61fc91cf9648ec5284e35c2b3c5

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 05:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024052165e08b7f025fe9b56e747d7e3368ed38cryptolocker.exe
Size

83KB
MD5

65e08b7f025fe9b56e747d7e3368ed38
SHA1

1c92ca8c3a59387c664bbe63f43750b4bb3abe38
SHA256

1047deaf786ef82a4b493c18d47f8ebc263af61fc91cf9648ec5284e35c2b3c5
SHA512

157fa583f975d681a7bf197c19be0313fd5d732cfc2a65446280b6f628db11efffaa6a57db69cd916394fecc3431595d3589eab6b9c8b05ee4b7bfd5f38b7b60
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMrhZ:TCjsIOtEvwDpj5HE/OUHnSMF

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3036	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2992	2024052165e08b7f025fe9b56e747d7e3368ed38cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 3036	2992	2024052165e08b7f025fe9b56e747d7e3368ed38cryptolocker.exe	28
PID 2992 wrote to memory of 3036	2992	2024052165e08b7f025fe9b56e747d7e3368ed38cryptolocker.exe	28
PID 2992 wrote to memory of 3036	2992	2024052165e08b7f025fe9b56e747d7e3368ed38cryptolocker.exe	28
PID 2992 wrote to memory of 3036	2992	2024052165e08b7f025fe9b56e747d7e3368ed38cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024052165e08b7f025fe9b56e747d7e3368ed38cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024052165e08b7f025fe9b56e747d7e3368ed38cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
83KB

MD5
75fc65af389df65d82ac00066aa32b30

SHA1
fa9305a39fd4eddc29b64c9244c5e993498e9618

SHA256
8e275405cd3aa63050cf028ee3bca91ee77110feb07930db43c4f3d6476b4556

SHA512
d19101cdd1abd2dee29d4fdf5db5b84e5a80c8364fdc2daa6d554101917209be44b727fa0b146ba103ab8d2fc00bbdbb16f726b6b81e29a5451b94cc386df7c6

Download Submit
memory/2992-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2992-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2992-3-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/2992-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2992-15-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/3036-17-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3036-24-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download