296740b42132aaadcc005457a1be28695e13c0a83e2563383fee0bb8d4b9e58f

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20240521d5fde12d5e95bb1962660a7866d57745cryptolocker.exe
Size

71KB
MD5

d5fde12d5e95bb1962660a7866d57745
SHA1

9db70740561db0cee23613cac13fb856a3ffba8e
SHA256

296740b42132aaadcc005457a1be28695e13c0a83e2563383fee0bb8d4b9e58f
SHA512

6e4624a8772ab2846f3855ac0f7fde1c5fd01d685dd8d8f5a29f49b0aa15e2be0e1be98e8eb01179e0df444aa6106614b7caed99f85b56fff72cf792086cc834
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4ZPsED3VK2+ZtyOjgO4r9vFAg2rq2g1B/Re:vj+jsMQMOtEvwDpj5HZYTjipvF242

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2808	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
3012	20240521d5fde12d5e95bb1962660a7866d57745cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2808	3012	20240521d5fde12d5e95bb1962660a7866d57745cryptolocker.exe	28
PID 3012 wrote to memory of 2808	3012	20240521d5fde12d5e95bb1962660a7866d57745cryptolocker.exe	28
PID 3012 wrote to memory of 2808	3012	20240521d5fde12d5e95bb1962660a7866d57745cryptolocker.exe	28
PID 3012 wrote to memory of 2808	3012	20240521d5fde12d5e95bb1962660a7866d57745cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\20240521d5fde12d5e95bb1962660a7866d57745cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\20240521d5fde12d5e95bb1962660a7866d57745cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
72KB

MD5
160105b9feba4e4a206397cee457da4e

SHA1
a181499893b20007cb857c46a2389883c289cbb2

SHA256
7df3591f3d8782bf5676ca7c4c8bcdabf81b72a31f1b7394b9492c399fe44a4f

SHA512
869ed6e2dd004036c7a4fc812cf3d29694f03c82eb1a7e5bff048d5c95c3ea6bf7bc8b4f584b9e6f96891b3a6c1eb13893fbbe6b243b6235461eb593c2539748

Download Submit
memory/2808-15-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2808-22-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/3012-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/3012-1-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/3012-8-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download