8e3fd6384d09b3e1f9595f1e500cd23269da57fff6bbc22949fbcfffd3f3f75e

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 07:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-09_62bd5446eefaf7863829a793fd1ac242_cryptolocker.exe
Size

30KB
MD5

62bd5446eefaf7863829a793fd1ac242
SHA1

21b2991c6da7b5e0c0c8d7aa506d4cc4bf2e0861
SHA256

8e3fd6384d09b3e1f9595f1e500cd23269da57fff6bbc22949fbcfffd3f3f75e
SHA512

3aee52f7b0dd8b349ea48aae0aa234d9300721de95cb18ac0b34f3ac851f7fd5edcd6eaed6bdab4db85ba12a05cd304837abda84b53abc0db296196df7d19b56
SSDEEP

384:v0VkMq01bJ3wtEwPS8HLEh+Jagz+3be+26Rsn1rCcOQtOOtEvwDpjqIGRS/Vb9he:vQz7yVEhs9+js1SQtOOtEvwDpjz9+aq

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2276	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2412	2024-08-09_62bd5446eefaf7863829a793fd1ac242_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-09_62bd5446eefaf7863829a793fd1ac242_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2276	2412	2024-08-09_62bd5446eefaf7863829a793fd1ac242_cryptolocker.exe	31
PID 2412 wrote to memory of 2276	2412	2024-08-09_62bd5446eefaf7863829a793fd1ac242_cryptolocker.exe	31
PID 2412 wrote to memory of 2276	2412	2024-08-09_62bd5446eefaf7863829a793fd1ac242_cryptolocker.exe	31
PID 2412 wrote to memory of 2276	2412	2024-08-09_62bd5446eefaf7863829a793fd1ac242_cryptolocker.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-08-09_62bd5446eefaf7863829a793fd1ac242_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-09_62bd5446eefaf7863829a793fd1ac242_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
30KB

MD5
574026e8734c78cd3ecd3081469f3c5c

SHA1
42b560a9cae8bd4868c052c93e47ac374f9f40b9

SHA256
26bd32b5fa9fe57b4bcd642806f5ef37604eb95c19f193213efadeeb0d4efea7

SHA512
20a56b9e838eec5601baad7863548cc6707fe62665f2d45c754dc1a030f2ca2f366465f96273f96f9abf83dc4b26f59800d4016e1c63c22017f976cd67557cfb

Download Submit
memory/2276-15-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/2276-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2412-1-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2412-8-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2412-0-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download