c2c62e4be1d02350700e53114861f33dfe464bc230741dee1610ee0de9beb5aa

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 19:11

Target

20240521d51e71f7a3b7b5efac94d2ed5db31328cryptolocker.exe
Size

44KB
MD5

d51e71f7a3b7b5efac94d2ed5db31328
SHA1

9757fb29701038d692473bde46b697d572874c39
SHA256

c2c62e4be1d02350700e53114861f33dfe464bc230741dee1610ee0de9beb5aa
SHA512

f493f8170919933fb18fb640b20d32bc52c2f9a2c4b826a24f55e16a11522d7f30f4868b075668ba6ddfc566bb2bc1024c4102b097fc7246a4b8451cc2185566
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/aMDp:6j+1NMOtEvwDpjrRr1

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2516 misid.exe
Loads dropped DLL 1 IoCs

Processes:

20240521d51e71f7a3b7b5efac94d2ed5db31328cryptolocker.exe

pid process

3040 20240521d51e71f7a3b7b5efac94d2ed5db31328cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2516	misid.exe

pid	process
3040	20240521d51e71f7a3b7b5efac94d2ed5db31328cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

20240521d51e71f7a3b7b5efac94d2ed5db31328cryptolocker.exe

description	pid	process	target process
PID 3040 wrote to memory of 2516	3040	20240521d51e71f7a3b7b5efac94d2ed5db31328cryptolocker.exe	misid.exe
PID 3040 wrote to memory of 2516	3040	20240521d51e71f7a3b7b5efac94d2ed5db31328cryptolocker.exe	misid.exe
PID 3040 wrote to memory of 2516	3040	20240521d51e71f7a3b7b5efac94d2ed5db31328cryptolocker.exe	misid.exe
PID 3040 wrote to memory of 2516	3040	20240521d51e71f7a3b7b5efac94d2ed5db31328cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\20240521d51e71f7a3b7b5efac94d2ed5db31328cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\20240521d51e71f7a3b7b5efac94d2ed5db31328cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2516

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
44KB

MD5
94f25c923f8ccd5e46f3ae4f2821229b

SHA1
053090b2323bfa7460a912647e0960ac87ce995e

SHA256
57e541e9614da9690fb393df4e258f50385d141b78b300c90d5e9ea1870b8501

SHA512
c540dc266b615e2732d12c1bd464dd5b7d7c3e15b3905235d0cb814f1eed6ff57ef93a5f2b2b96ba7ce8da553329febe6dfe10a9101cfc0a6ecedd511a1c19fc

Download Submit
memory/2516-17-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/2516-24-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2516-25-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3040-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3040-1-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/3040-2-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/3040-9-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/3040-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download