4b4a95141bb89d4ce4436dcd0363955af9006a322e50023898e1965743edd10b

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 19:12

Target

20240521797e53d58f0cf2ec486ed37cab9564ffcryptolocker.exe
Size

57KB
MD5

797e53d58f0cf2ec486ed37cab9564ff
SHA1

3c1e7546abb81710ce3faa8acacc857f3509c0ca
SHA256

4b4a95141bb89d4ce4436dcd0363955af9006a322e50023898e1965743edd10b
SHA512

35f1b87ca650a52427fbf225d07e8acfd929a300ec035f09ec06fbf5718ca553e91d64d509b03270a229a87bb349263efce68f846db9bed11bde2f6ed1540f13
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5QJz7/e4O:6j+1NMOtEvwDpjr8oxExe4O

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2504 misid.exe
Loads dropped DLL 1 IoCs

Processes:

20240521797e53d58f0cf2ec486ed37cab9564ffcryptolocker.exe

pid process

2092 20240521797e53d58f0cf2ec486ed37cab9564ffcryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2504	misid.exe

pid	process
2092	20240521797e53d58f0cf2ec486ed37cab9564ffcryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

20240521797e53d58f0cf2ec486ed37cab9564ffcryptolocker.exe

description	pid	process	target process
PID 2092 wrote to memory of 2504	2092	20240521797e53d58f0cf2ec486ed37cab9564ffcryptolocker.exe	misid.exe
PID 2092 wrote to memory of 2504	2092	20240521797e53d58f0cf2ec486ed37cab9564ffcryptolocker.exe	misid.exe
PID 2092 wrote to memory of 2504	2092	20240521797e53d58f0cf2ec486ed37cab9564ffcryptolocker.exe	misid.exe
PID 2092 wrote to memory of 2504	2092	20240521797e53d58f0cf2ec486ed37cab9564ffcryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\20240521797e53d58f0cf2ec486ed37cab9564ffcryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\20240521797e53d58f0cf2ec486ed37cab9564ffcryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2504

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
57KB

MD5
e8fa180830fdbd8c00dc7c2b03bc0255

SHA1
d666c89bd875bccb7651f91a30d1d38d39cddb5a

SHA256
bbebc9d599cd80beb75b824ec41ef4d87cfc74f54f725a6a79abac8f240b84ee

SHA512
2eaba7f4b66b7c61aa5d16a56f686ed7ab481247085f71f35bc2a66c67f4ac9bfc78662555f6cae4cd81fa2bf1cfc58458abd7d3b10f8f96a706305867a19cc4

Download Submit
memory/2092-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2092-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2092-2-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/2092-9-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2092-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2504-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2504-18-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2504-25-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2504-26-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download