db1cdcb61ba1a59096d7f8992db2693281f7f0f9c0ed9ba65e509d6a517b346e

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 19:23

Target

2024052125b3f0f2c796cd36c9da555434438be7cryptolocker.exe
Size

37KB
MD5

25b3f0f2c796cd36c9da555434438be7
SHA1

c31d8c6b8919963687b8fd7588bdfd5909e0d9c3
SHA256

db1cdcb61ba1a59096d7f8992db2693281f7f0f9c0ed9ba65e509d6a517b346e
SHA512

cb79c5323f92701112a97b0a95f5df0ad8de63845a722dc42e81e526266da9eb3f44e74154437fc9f42f03815f94119ca2343ddf40de3500acc7dba8518d179b
SSDEEP

768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4qo:fT+hsMQMOtEvwDpjoIHX

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2972 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024052125b3f0f2c796cd36c9da555434438be7cryptolocker.exe

pid process

3056 2024052125b3f0f2c796cd36c9da555434438be7cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2972	misid.exe

pid	process
3056	2024052125b3f0f2c796cd36c9da555434438be7cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024052125b3f0f2c796cd36c9da555434438be7cryptolocker.exe

description	pid	process	target process
PID 3056 wrote to memory of 2972	3056	2024052125b3f0f2c796cd36c9da555434438be7cryptolocker.exe	misid.exe
PID 3056 wrote to memory of 2972	3056	2024052125b3f0f2c796cd36c9da555434438be7cryptolocker.exe	misid.exe
PID 3056 wrote to memory of 2972	3056	2024052125b3f0f2c796cd36c9da555434438be7cryptolocker.exe	misid.exe
PID 3056 wrote to memory of 2972	3056	2024052125b3f0f2c796cd36c9da555434438be7cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024052125b3f0f2c796cd36c9da555434438be7cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024052125b3f0f2c796cd36c9da555434438be7cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2972

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
38KB

MD5
255af4b5524e54ddce0227d0cfe63800

SHA1
28cf24096d81482f1c61fd0f141a4682d76177c4

SHA256
09333bc4ca013f1c088028bce846b2dc36f8a84a592bb0f4d70164f746069070

SHA512
c037f86c3fdb6ac118375df19eb53930b5807f1716855b7e2e47c0289aa23c405941c62dcd0a9505385e1678335c6b52378896ee6ae03e6d8429f032f2ca67e9

Download Submit
memory/2972-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2972-15-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/3056-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3056-1-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/3056-8-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download