51c5fd50dad412619bc3e7fccc10bd64ec57398cbe1622425532a2401238ee6a

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024052153459cb417384be20ab946cf311c352acryptolocker.exe
Size

37KB
MD5

53459cb417384be20ab946cf311c352a
SHA1

853dc7ed4652f355bc26f7f94370e6e3f0e66df1
SHA256

51c5fd50dad412619bc3e7fccc10bd64ec57398cbe1622425532a2401238ee6a
SHA512

03d11bcfe37a90494440dd8d43e238da3ceef3d7b40eb42233404dce7477fefe7787111e7144c7b703b68a77dd67396f9c7063fe327b7160ae480e20aab7a854
SSDEEP

768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4q7:fT+hsMQMOtEvwDpjoIHE

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2504	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2156	2024052153459cb417384be20ab946cf311c352acryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2504	2156	2024052153459cb417384be20ab946cf311c352acryptolocker.exe	28
PID 2156 wrote to memory of 2504	2156	2024052153459cb417384be20ab946cf311c352acryptolocker.exe	28
PID 2156 wrote to memory of 2504	2156	2024052153459cb417384be20ab946cf311c352acryptolocker.exe	28
PID 2156 wrote to memory of 2504	2156	2024052153459cb417384be20ab946cf311c352acryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024052153459cb417384be20ab946cf311c352acryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024052153459cb417384be20ab946cf311c352acryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
37KB

MD5
89be1259ddd320b5b99cd4f2bb6d7e61

SHA1
8b6c411f617fb0718d71eeea1f35e59a723c080d

SHA256
a63f6ffc50cbac5586b51b8620fb08b527da393bcc7efe1fa46244719ab2c1b9

SHA512
6a8934e691bed3166a49e4b6b40db616e51a4e0def8bd9ea3f42031a782cbeb4bbd0a4360f4570946d9f7c65c7978974e0e531a0f448b607203450db4a2417f1

Download Submit
memory/2156-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2156-1-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2156-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2504-15-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2504-22-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download