9cc21002504af33650fa4c2fb07ba9a94b9a74904c5c0950c99918fbdef2c1d5

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 05:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-18_8189d92276e2bb1ca14f7dfef72faef9_cryptolocker.exe
Size

73KB
MD5

8189d92276e2bb1ca14f7dfef72faef9
SHA1

177d3c9435c6d8d2f675ce5f35143d6320b8ba0a
SHA256

9cc21002504af33650fa4c2fb07ba9a94b9a74904c5c0950c99918fbdef2c1d5
SHA512

d6550edc4555fe637938554f3d831056b5c2d01476f35f8ab2782b35cc10e8961bee940cf8b1f9e66ca6de7c18a1dfc5d78f2ac7ab32fa113fe876175462682e
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4ZPsED3VK2+ZtyOjgO4r9vFAg2rq2g1B/RJ:vj+jsMQMOtEvwDpj5HZYTjipvF24GW

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2124	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2452	2024-08-18_8189d92276e2bb1ca14f7dfef72faef9_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-18_8189d92276e2bb1ca14f7dfef72faef9_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2124	2452	2024-08-18_8189d92276e2bb1ca14f7dfef72faef9_cryptolocker.exe	31
PID 2452 wrote to memory of 2124	2452	2024-08-18_8189d92276e2bb1ca14f7dfef72faef9_cryptolocker.exe	31
PID 2452 wrote to memory of 2124	2452	2024-08-18_8189d92276e2bb1ca14f7dfef72faef9_cryptolocker.exe	31
PID 2452 wrote to memory of 2124	2452	2024-08-18_8189d92276e2bb1ca14f7dfef72faef9_cryptolocker.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-08-18_8189d92276e2bb1ca14f7dfef72faef9_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-18_8189d92276e2bb1ca14f7dfef72faef9_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
73KB

MD5
bb4df1fe6efe5a02135a7e8957bc3ffa

SHA1
0640801e37a80dabf5d2ccb4c81ab17abc200975

SHA256
659903907d1ca872fd7523cd55c5ee0d4e8f2e3b55a8a082ed6e76233ae8a1c0

SHA512
d52b548b40330fcb849965b60396764550d856dfe9acb92b23287c329f3cb2fa576fd590d025a7857caac1095fe005d3ff4d3c3f87b3625edfadac131012d04d

Download Submit
memory/2124-15-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2124-21-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2452-0-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2452-1-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2452-8-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download