d45a1912a7922152a994789ebffef0c384976330a2d377017ca38910e6494611

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 19:11

Target

202405215e282d7cc269cbd878d233ca96c60843cryptolocker.exe
Size

48KB
MD5

5e282d7cc269cbd878d233ca96c60843
SHA1

2ae97202e67d226255db91d4a297791505a6ba73
SHA256

d45a1912a7922152a994789ebffef0c384976330a2d377017ca38910e6494611
SHA512

9e6b499356e1d43b79b5d799a2a0714c2a39aa57c485a1054fdab08e8cdb12a6a835b72440243b9aca5ee8e376446cab9af90f8be92a53056eb52b1612f99959
SSDEEP

384:icX+ni9VCr5nQI021q4VQBqURYp055TOtOOtEvwDpjqIGR/hHi7/OlI0G/BdmRSN:XS5nQJ24LR1bytOOtEvwDpjNbP/bmO

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2016 misid.exe
Loads dropped DLL 1 IoCs

Processes:

202405215e282d7cc269cbd878d233ca96c60843cryptolocker.exe

pid process

1676 202405215e282d7cc269cbd878d233ca96c60843cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2016	misid.exe

pid	process
1676	202405215e282d7cc269cbd878d233ca96c60843cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

202405215e282d7cc269cbd878d233ca96c60843cryptolocker.exe

description	pid	process	target process
PID 1676 wrote to memory of 2016	1676	202405215e282d7cc269cbd878d233ca96c60843cryptolocker.exe	misid.exe
PID 1676 wrote to memory of 2016	1676	202405215e282d7cc269cbd878d233ca96c60843cryptolocker.exe	misid.exe
PID 1676 wrote to memory of 2016	1676	202405215e282d7cc269cbd878d233ca96c60843cryptolocker.exe	misid.exe
PID 1676 wrote to memory of 2016	1676	202405215e282d7cc269cbd878d233ca96c60843cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\202405215e282d7cc269cbd878d233ca96c60843cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\202405215e282d7cc269cbd878d233ca96c60843cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2016

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
48KB

MD5
f3e55d37c9d7e442080f41958e90bcea

SHA1
1c30468b385e5bf92044de206b256c09e376fb53

SHA256
17a3956de4ca2cb02c2c2669d76f0eb8c422b4fc103408a16f0f6634e90e8e05

SHA512
7f8a49c7ae80e63160cbb480a7ae74225cbabda5019c9a364c3f22bb0a2f3643e892e43054dc11d1fc7a4e7560a3be38ed4704ce3394a5a9915b8fbdde790194

Download Submit
memory/1676-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1676-1-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1676-2-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/1676-9-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1676-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1676-14-0x00000000006D0000-0x00000000006DF000-memory.dmp

Filesize
60KB

Download
memory/2016-18-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2016-27-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2016-20-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2016-28-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download