6ebb26a5ec3986e65fe97a69d25cb8295a027500ed6a28654cb82c3af94d1297

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 18:51

Target

20240521f0e442e3b9dbb1f0f3fb04f835b9cb19cryptolocker.exe
Size

37KB
MD5

f0e442e3b9dbb1f0f3fb04f835b9cb19
SHA1

77e45166128ee3262748082fae51203135e85300
SHA256

6ebb26a5ec3986e65fe97a69d25cb8295a027500ed6a28654cb82c3af94d1297
SHA512

a3b05061e8258dfcef830f3af838eacbfdee72733682d0399494e0e040bd5fa8be2d22fa88d24adf499b899ee2ae363322a0bbc77d5b8bcc4bff47e1956ad0f5
SSDEEP

768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4W:fT+hsMQMOtEvwDpjoIHW

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2956 misid.exe
Loads dropped DLL 1 IoCs

Processes:

20240521f0e442e3b9dbb1f0f3fb04f835b9cb19cryptolocker.exe

pid process

2912 20240521f0e442e3b9dbb1f0f3fb04f835b9cb19cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2956	misid.exe

pid	process
2912	20240521f0e442e3b9dbb1f0f3fb04f835b9cb19cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

20240521f0e442e3b9dbb1f0f3fb04f835b9cb19cryptolocker.exe

description	pid	process	target process
PID 2912 wrote to memory of 2956	2912	20240521f0e442e3b9dbb1f0f3fb04f835b9cb19cryptolocker.exe	misid.exe
PID 2912 wrote to memory of 2956	2912	20240521f0e442e3b9dbb1f0f3fb04f835b9cb19cryptolocker.exe	misid.exe
PID 2912 wrote to memory of 2956	2912	20240521f0e442e3b9dbb1f0f3fb04f835b9cb19cryptolocker.exe	misid.exe
PID 2912 wrote to memory of 2956	2912	20240521f0e442e3b9dbb1f0f3fb04f835b9cb19cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2956

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
37KB

MD5
41ad570a55c46e34edf8029820f1f070

SHA1
cc020fea461516a24fc1ea1b4f178d0eb4fdaa42

SHA256
12f358caebe313e591d5518cf6ed96665703fd14373e04e38a930e7e80b21832

SHA512
c6643ec4900a0d414cce16320e693b2207b878a04e5f671a9a745d14131965f44ba20558a6d0b2fd6fde76649cd1d5fce6afd10ce626d1fc039077d8f35313d4

Download Submit
memory/2912-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2912-1-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2912-8-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2956-15-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2956-22-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download