2f52cf797f40794e0dd86f9845620ca734d31c189596c271e5c2f5c92b11988d

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-10_21072090005d2c3bb3484c34fe374479_cryptolocker.exe
Size

30KB
MD5

21072090005d2c3bb3484c34fe374479
SHA1

f20c03d711a2373edbe5cd3fc79decfea7208c40
SHA256

2f52cf797f40794e0dd86f9845620ca734d31c189596c271e5c2f5c92b11988d
SHA512

effe12456c5a40218ff506b6f1b61d9bc60a32f3a053b13f41565265a619e26977118f4548d5587db7a43174dd3960217ce5909dcea1687720584532c272bff5
SSDEEP

384:v0VkMq01bJ3wtEwPS8HLEh+Jagz+3be+26Rsn1rCcOQtOOtEvwDpjqIGRS/Vb9hz:vQz7yVEhs9+js1SQtOOtEvwDpjz9+9s

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2732	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1996	2024-08-10_21072090005d2c3bb3484c34fe374479_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-10_21072090005d2c3bb3484c34fe374479_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2732	1996	2024-08-10_21072090005d2c3bb3484c34fe374479_cryptolocker.exe	30
PID 1996 wrote to memory of 2732	1996	2024-08-10_21072090005d2c3bb3484c34fe374479_cryptolocker.exe	30
PID 1996 wrote to memory of 2732	1996	2024-08-10_21072090005d2c3bb3484c34fe374479_cryptolocker.exe	30
PID 1996 wrote to memory of 2732	1996	2024-08-10_21072090005d2c3bb3484c34fe374479_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-08-10_21072090005d2c3bb3484c34fe374479_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-10_21072090005d2c3bb3484c34fe374479_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
30KB

MD5
3afe1d44d5e5ee0e8944b8597edde89a

SHA1
b9e1844d9e2f590cc99e72e9ddf256f27d5e23a4

SHA256
4cd6d3e73f25362cc3ea25cab7df1245a0dd6c66e58b952d58dcc087b91dab88

SHA512
793ab3f9390efeaeadcf44e005127a3a647fa0ecb0b6d8f8bb27e147535e959e21f2619bf0eaaa8b156d1937a2e5c28efcd1273962eba65ed4510791cebc2b6e

Download Submit
memory/1996-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1996-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1996-2-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2732-22-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2732-15-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download