c58c6c541f9a63b8adcf6e711b9a8c1010e18f79c5b0684924cff5aa4c94f7d7

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-26_426d10dd34e9e94f7f75a301bfa0726a_cryptolocker.exe
Size

51KB
MD5

426d10dd34e9e94f7f75a301bfa0726a
SHA1

e90117c829113e89d4bbec3c3cda912503413d3c
SHA256

c58c6c541f9a63b8adcf6e711b9a8c1010e18f79c5b0684924cff5aa4c94f7d7
SHA512

c07a04852f92f7f975f01ebfb3793388a64a5e2f4a0bccaf34344b7662b3833dad193d09599d57d11efb7c5cc17fff3c4e82e4126a78e3c8335c757781e48ce1
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrr42A7n0FmB0ndd:vj+jsMQMOtEvwDpj5HczerLO04Bad

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2696	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1660	2024-07-26_426d10dd34e9e94f7f75a301bfa0726a_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-07-26_426d10dd34e9e94f7f75a301bfa0726a_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2696	1660	2024-07-26_426d10dd34e9e94f7f75a301bfa0726a_cryptolocker.exe	30
PID 1660 wrote to memory of 2696	1660	2024-07-26_426d10dd34e9e94f7f75a301bfa0726a_cryptolocker.exe	30
PID 1660 wrote to memory of 2696	1660	2024-07-26_426d10dd34e9e94f7f75a301bfa0726a_cryptolocker.exe	30
PID 1660 wrote to memory of 2696	1660	2024-07-26_426d10dd34e9e94f7f75a301bfa0726a_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-07-26_426d10dd34e9e94f7f75a301bfa0726a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-26_426d10dd34e9e94f7f75a301bfa0726a_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
51KB

MD5
cc75ad46daad8fc155fac89fc420cc5e

SHA1
763a8effc6fb747feaacddea1ad8180df7128d27

SHA256
a03a971e82e030f5a47c07a5d6fd23d3833da943769af51ca5476e7c1d825d9c

SHA512
63a0a260d9c0487681e5bd767d72ed3dbd9f66a670923c988d95576b8c608715fd0f7d399c3bb415b7a8ffde9e9af747842e8fe58f0c73fd8c566c75782093be

Download Submit
memory/1660-0-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/1660-1-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/1660-8-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2696-15-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download