bc97a4a68c08d7fecffc06b7925530b91889c840d51874c8781eef3d3f3971ee

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 19:16

Target

20240521a8a4018b79c77a0cb13644dc06adecebcryptolocker.exe
Size

68KB
MD5

a8a4018b79c77a0cb13644dc06adeceb
SHA1

e41389b74f55de64cd2937d2c4b9a33d398aed84
SHA256

bc97a4a68c08d7fecffc06b7925530b91889c840d51874c8781eef3d3f3971ee
SHA512

3f9350a243476eba72e1e3c7cc943947c9413786f21a6119db825a73d63309de94f976bd74f08114dcfeab56e4515487fe210f99518bb0254a42c8a2b0e99606
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEpE0P/xFII:6j+1NMOtEvwDpjr8ox8UDEpN/jV

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2828 misid.exe
Loads dropped DLL 1 IoCs

Processes:

20240521a8a4018b79c77a0cb13644dc06adecebcryptolocker.exe

pid process

2648 20240521a8a4018b79c77a0cb13644dc06adecebcryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2828	misid.exe

pid	process
2648	20240521a8a4018b79c77a0cb13644dc06adecebcryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

20240521a8a4018b79c77a0cb13644dc06adecebcryptolocker.exe

description	pid	process	target process
PID 2648 wrote to memory of 2828	2648	20240521a8a4018b79c77a0cb13644dc06adecebcryptolocker.exe	misid.exe
PID 2648 wrote to memory of 2828	2648	20240521a8a4018b79c77a0cb13644dc06adecebcryptolocker.exe	misid.exe
PID 2648 wrote to memory of 2828	2648	20240521a8a4018b79c77a0cb13644dc06adecebcryptolocker.exe	misid.exe
PID 2648 wrote to memory of 2828	2648	20240521a8a4018b79c77a0cb13644dc06adecebcryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\20240521a8a4018b79c77a0cb13644dc06adecebcryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\20240521a8a4018b79c77a0cb13644dc06adecebcryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2828

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
68KB

MD5
325372179bedf69dbf52b405239ab401

SHA1
0a47f864a02e423fcce4ee0577484c6eab634394

SHA256
4177858f018e03506b73601e3723650d3475751af9cf115cd2b00e85da60b31d

SHA512
b5765b455f4249934807514274375f273882478d881f6410357f1e9b6d4f2a84fa3a586e5c722eb615d2b646380cf2adfba8bd40b78b91351376a27ade20079e

Download Submit
memory/2648-2-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2648-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2648-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2648-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2648-12-0x0000000001EC0000-0x0000000001ECF000-memory.dmp

Filesize
60KB

Download
memory/2648-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2828-25-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download