649053328aee94049d367e57f49ed06df515d0cf97c1b5194745919894146130

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-26_4be4d5754e3b1e98ac0a44380d7fef28_cryptolocker.exe
Size

72KB
MD5

4be4d5754e3b1e98ac0a44380d7fef28
SHA1

05a302fd4cabcb35823b99f9442bbf3ca5ce6c79
SHA256

649053328aee94049d367e57f49ed06df515d0cf97c1b5194745919894146130
SHA512

1c623d75e01d0d52ebc33ea521addfd2d5ec35f52a38f2528e832c607bbf1359cdf5c130d469107919b45bc64c28e34575a96c04b51d6b36cc40312a177670c3
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4ZPsED3VK2+ZtyOjgO4r9vFAg2rq2g1B/Rp:vj+jsMQMOtEvwDpj5HZYTjipvF24x

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1708	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1020	2024-07-26_4be4d5754e3b1e98ac0a44380d7fef28_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-07-26_4be4d5754e3b1e98ac0a44380d7fef28_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 1708	1020	2024-07-26_4be4d5754e3b1e98ac0a44380d7fef28_cryptolocker.exe	29
PID 1020 wrote to memory of 1708	1020	2024-07-26_4be4d5754e3b1e98ac0a44380d7fef28_cryptolocker.exe	29
PID 1020 wrote to memory of 1708	1020	2024-07-26_4be4d5754e3b1e98ac0a44380d7fef28_cryptolocker.exe	29
PID 1020 wrote to memory of 1708	1020	2024-07-26_4be4d5754e3b1e98ac0a44380d7fef28_cryptolocker.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-07-26_4be4d5754e3b1e98ac0a44380d7fef28_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-26_4be4d5754e3b1e98ac0a44380d7fef28_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
73KB

MD5
054dd9d093c29e51228f827cdaaf9c91

SHA1
bb17ea755839c25afcf31999c2fb36ec9d87c7cd

SHA256
e8ada49e5c49f1b9969aa0fe018dc3c91fb0c9988b93f44735bfceae99237eff

SHA512
211995520d5e4a1b3b0afd557c1b8f7ce5923bd4b4102e3265d1f2ed309b98d6be3f713eab044d7d1396b2d3dd92795f0974834af322d8615c4c0d40ab33db01

Download Submit
memory/1020-1-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/1020-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1020-8-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1708-22-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1708-15-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download