9ce5bb2e792e9157e60e72bffa6344e7bf6c382f53e0141423b7838911ce83be

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 11:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-10_3f353909f9024ffc362f0060fc84462d_cryptolocker.exe
Size

52KB
MD5

3f353909f9024ffc362f0060fc84462d
SHA1

bc2c27b1128f566406cbd52a7b7225cc5ffcff47
SHA256

9ce5bb2e792e9157e60e72bffa6344e7bf6c382f53e0141423b7838911ce83be
SHA512

1e1a4a6350466d5037320e146e272d78357d82bca684af154a073eca52462ae87a02e0a150826a7f154020edadfd9871e066d31f77c496b4d677853ba8dfe15d
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrr42A7n0FmB0n5:vj+jsMQMOtEvwDpj5HczerLO04Bu

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2972	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2516	2024-08-10_3f353909f9024ffc362f0060fc84462d_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-10_3f353909f9024ffc362f0060fc84462d_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2972	2516	2024-08-10_3f353909f9024ffc362f0060fc84462d_cryptolocker.exe	30
PID 2516 wrote to memory of 2972	2516	2024-08-10_3f353909f9024ffc362f0060fc84462d_cryptolocker.exe	30
PID 2516 wrote to memory of 2972	2516	2024-08-10_3f353909f9024ffc362f0060fc84462d_cryptolocker.exe	30
PID 2516 wrote to memory of 2972	2516	2024-08-10_3f353909f9024ffc362f0060fc84462d_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-08-10_3f353909f9024ffc362f0060fc84462d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-10_3f353909f9024ffc362f0060fc84462d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
53KB

MD5
99b54967dcad7fef38711b14921fcfc0

SHA1
726cf089a1a01f76c8ad5b42491899a86b3205be

SHA256
73f2be35838c0c629a63ee41ce0e5ce02626e2ca570a8035b3e0a1766e003cd7

SHA512
c8b6ea18ba237e8c9f28b107c21836e2245d8a2e34aa795432fe9a67d624d6d01c61b0505d576739a8255e9620e3d34ee0661eb5addee35b5b707004ccc0189c

Download Submit
memory/2516-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2516-1-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2516-8-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2972-22-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2972-15-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download