Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 07:04
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-25_eb42399e474e63b70233237d52bde9e6_cryptolocker.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-08-25_eb42399e474e63b70233237d52bde9e6_cryptolocker.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-25_eb42399e474e63b70233237d52bde9e6_cryptolocker.exe
-
Size
31KB
-
MD5
eb42399e474e63b70233237d52bde9e6
-
SHA1
9d1127076c4240f764aa85c7ef44ad20cc7acd74
-
SHA256
7ed3cebc19ee2e5bf6d81b7a87a9b8f33cb005782edfb95cd75a67f2b17ca45b
-
SHA512
0ceb4857d31365d5a441cfcebee7357620d7424f4b09fa5d817f7908ec7a0511d1886325489b0915c398fc6763bf58fdcc5a773b826f902c478cd328bb8970f8
-
SSDEEP
384:v0VkMq01bJ3wtEwPS8HLEh+Jagz+3be+26Rsn1rCcOQtOOtEvwDpjqIGRS/Vb9h3:vQz7yVEhs9+js1SQtOOtEvwDpjz9+9A
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2084 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 2528 2024-08-25_eb42399e474e63b70233237d52bde9e6_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-08-25_eb42399e474e63b70233237d52bde9e6_cryptolocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language misid.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2528 wrote to memory of 2084 2528 2024-08-25_eb42399e474e63b70233237d52bde9e6_cryptolocker.exe 30 PID 2528 wrote to memory of 2084 2528 2024-08-25_eb42399e474e63b70233237d52bde9e6_cryptolocker.exe 30 PID 2528 wrote to memory of 2084 2528 2024-08-25_eb42399e474e63b70233237d52bde9e6_cryptolocker.exe 30 PID 2528 wrote to memory of 2084 2528 2024-08-25_eb42399e474e63b70233237d52bde9e6_cryptolocker.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-25_eb42399e474e63b70233237d52bde9e6_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-25_eb42399e474e63b70233237d52bde9e6_cryptolocker.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2084
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD5b75134b1e18010f1672bc1f95775d547
SHA1e9e9338fa4dee6305188d7c6f637dfcff96602d8
SHA256f5abf08c92bad27a7400e070929cd3bdbba623c70ff8718e8d529944da2df646
SHA5120de993ab74016758c0ac8c1b7311daaecac61ba3ccceb0c1ad85a47e7122ee913c071dab270e2f2e2b1c9d17d888245199a728bdb807fc05b795020c5d93e472