cdadce1f606fa52060f804ce3a1803d839b3862114401df0dea370a97e3eec6b

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-07-05_63a938a3849ed3c78e3ac64e5b12eccd_cryptolocker.exe
Size

84KB
MD5

63a938a3849ed3c78e3ac64e5b12eccd
SHA1

26c2257e9bf8f1de5c993f447ee23329e6af016f
SHA256

cdadce1f606fa52060f804ce3a1803d839b3862114401df0dea370a97e3eec6b
SHA512

94dc348dda9a2787997bde5c2ddcee078226b8a317faacd09313de411af6e7aab928b4fd0c1673dc762430365a2cd0efbbcc1fa5d20eb219c538b907017a3e59
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMrCO:TCjsIOtEvwDpj5HE/OUHnSM/

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2260	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
304	2024-07-05_63a938a3849ed3c78e3ac64e5b12eccd_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 304 wrote to memory of 2260	304	2024-07-05_63a938a3849ed3c78e3ac64e5b12eccd_cryptolocker.exe	30
PID 304 wrote to memory of 2260	304	2024-07-05_63a938a3849ed3c78e3ac64e5b12eccd_cryptolocker.exe	30
PID 304 wrote to memory of 2260	304	2024-07-05_63a938a3849ed3c78e3ac64e5b12eccd_cryptolocker.exe	30
PID 304 wrote to memory of 2260	304	2024-07-05_63a938a3849ed3c78e3ac64e5b12eccd_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-07-05_63a938a3849ed3c78e3ac64e5b12eccd_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-05_63a938a3849ed3c78e3ac64e5b12eccd_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:304
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
84KB

MD5
fb7f0a4f3b5744a06e2cdf2374b49e46

SHA1
7a4ba69aa5e34fae81a5aade60f1b88345bbc0dc

SHA256
e5991eaa902754cb93b1e8d333e11e4109a71332a4af700669989a6edecc5f14

SHA512
4a2a3b47dfd588be2a707f27b359bb9c662472765990edd735dd376bbd03da6294f0112d8c343c9849720b49a98e2bacc3bdbb5d071cb6fc437132f3e82f6e73

Download Submit
memory/304-1-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/304-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/304-9-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/304-2-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/304-15-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2260-16-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2260-25-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2260-18-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2260-26-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download