ae69b2097dd0db85f2453a131053c6c839b59df8c09a31ba9776d25d6c475852

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05-09-2024 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-05_df1a063208c8e09fc01f61db16cd7038_cryptolocker.exe
Size

79KB
MD5

df1a063208c8e09fc01f61db16cd7038
SHA1

5011699e2ae41f063156129bdd6250decc089675
SHA256

ae69b2097dd0db85f2453a131053c6c839b59df8c09a31ba9776d25d6c475852
SHA512

eea11c728e94027fbcbe811a32729a472f8e47584230ec7ff6f85ff49a9e2f73d9f16ff9849479dc48624a5520a49dd4d0e5c07e879f2e1d4ff957df93f3aef8
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ3KUJ2:ZVxkGOtEvwDpjca12

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2704	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2368	2024-09-05_df1a063208c8e09fc01f61db16cd7038_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-05_df1a063208c8e09fc01f61db16cd7038_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2704	2368	2024-09-05_df1a063208c8e09fc01f61db16cd7038_cryptolocker.exe	29
PID 2368 wrote to memory of 2704	2368	2024-09-05_df1a063208c8e09fc01f61db16cd7038_cryptolocker.exe	29
PID 2368 wrote to memory of 2704	2368	2024-09-05_df1a063208c8e09fc01f61db16cd7038_cryptolocker.exe	29
PID 2368 wrote to memory of 2704	2368	2024-09-05_df1a063208c8e09fc01f61db16cd7038_cryptolocker.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-09-05_df1a063208c8e09fc01f61db16cd7038_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-05_df1a063208c8e09fc01f61db16cd7038_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
80KB

MD5
2ae5036dfc5b9f925ad205fb318738b9

SHA1
f9443ce8faf3a4e2d4f7498c704e8c6c5df83899

SHA256
3a17d64e54f758df378d570e9d014356bd8cb291bccd33c134003ba82e807b60

SHA512
496cc117e9014fdb5059816bf6a413fbfdd8221a356b1575d4c4d1d13a8e64d79c415e519524681885816981634cf37634fd516dfbe9ddbd98747a85e2f33654

Download Submit
memory/2368-0-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download
memory/2368-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2368-2-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2368-3-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/2704-18-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2704-17-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2704-15-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download