35aa1799c416c72c6ba107c4dbd5022335d1c13c8b6d27cd128c04d93268dbfa

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 06:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-26_449b3080ef5e5c3ed8c382cb26b1f65c_cryptolocker.exe
Size

47KB
MD5

449b3080ef5e5c3ed8c382cb26b1f65c
SHA1

b5894f837215a4a740c7638301557963689869f4
SHA256

35aa1799c416c72c6ba107c4dbd5022335d1c13c8b6d27cd128c04d93268dbfa
SHA512

29fbcb02024da0fa50fe2301e9cf797dedb75f23b0562399e95d69016ab804ece37703651219e8cdc9bc726669679ed3cb7844c2c4b97ab5011524cf5e449136
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/aMDhkJ0:6j+1NMOtEvwDpjrRraJ0

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2232	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2116	2024-08-26_449b3080ef5e5c3ed8c382cb26b1f65c_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-26_449b3080ef5e5c3ed8c382cb26b1f65c_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2232	2116	2024-08-26_449b3080ef5e5c3ed8c382cb26b1f65c_cryptolocker.exe	31
PID 2116 wrote to memory of 2232	2116	2024-08-26_449b3080ef5e5c3ed8c382cb26b1f65c_cryptolocker.exe	31
PID 2116 wrote to memory of 2232	2116	2024-08-26_449b3080ef5e5c3ed8c382cb26b1f65c_cryptolocker.exe	31
PID 2116 wrote to memory of 2232	2116	2024-08-26_449b3080ef5e5c3ed8c382cb26b1f65c_cryptolocker.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-08-26_449b3080ef5e5c3ed8c382cb26b1f65c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-26_449b3080ef5e5c3ed8c382cb26b1f65c_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
47KB

MD5
9bee1f2460d32dd122279ce5d6e6fd17

SHA1
7c0cebc66ab48c5bfebe7e7e5df37d0b414213b4

SHA256
626eced1207de7106d8c6e34ac9991e5b5b358c8c0a75b63d6924ed26a26804e

SHA512
0234306fdf882ea06fec28576839315bea3ef14f66f1e4320b49b6145412ce54591c471decd3c0fc965babc0d5eaa83ffa3de80f680579734ac312ad98b53ae3

Download Submit
memory/2116-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2116-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2116-2-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2116-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2116-13-0x00000000004E0000-0x00000000004EF000-memory.dmp

Filesize
60KB

Download
memory/2116-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2232-25-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2232-18-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2232-26-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download