72b03a8935f9d119de4874486a46b5bbbd44567be38bb6f6d4b97b864f9dd9ba

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 06:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-06_bc8da5a67db6ffdb653cc061a965d025_cryptolocker.exe
Size

40KB
MD5

bc8da5a67db6ffdb653cc061a965d025
SHA1

04199c25afe0f629c3e1ec07fc17943b06e42f7b
SHA256

72b03a8935f9d119de4874486a46b5bbbd44567be38bb6f6d4b97b864f9dd9ba
SHA512

c2aca7ad6cda59254de0cff4925884bb8057bf387d32c1b51c44cf0f85e95ac66190cfc7f445fb10fd83582f380dd1a71d2831b5a3a2039f2d1ab9f516c69fec
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLeJAsKuD+Z:ZzFbxmLPWQMOtEvwDpjLeJAsKck

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2328	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1984	2024-09-06_bc8da5a67db6ffdb653cc061a965d025_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-06_bc8da5a67db6ffdb653cc061a965d025_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2328	1984	2024-09-06_bc8da5a67db6ffdb653cc061a965d025_cryptolocker.exe	30
PID 1984 wrote to memory of 2328	1984	2024-09-06_bc8da5a67db6ffdb653cc061a965d025_cryptolocker.exe	30
PID 1984 wrote to memory of 2328	1984	2024-09-06_bc8da5a67db6ffdb653cc061a965d025_cryptolocker.exe	30
PID 1984 wrote to memory of 2328	1984	2024-09-06_bc8da5a67db6ffdb653cc061a965d025_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-09-06_bc8da5a67db6ffdb653cc061a965d025_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-06_bc8da5a67db6ffdb653cc061a965d025_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
41KB

MD5
12bbe48076a04cb6598e962a1c80852c

SHA1
cdcf3d0a9431ec82b0c93582c6444e15391d9ab2

SHA256
9f1a0c2598bdabc78cb3d80c193d33900f57ea752339fbda8d67b37796e34a5e

SHA512
c673befbd598d3eda0fd1f5439906c40348b62024304afbf0fa5fcabee144d7f970cfeb03ee86008be63a7acdc8cff96b9b9d88214b7952650d9964438d50c09

Download Submit
memory/1984-0-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/1984-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1984-2-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/1984-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2328-18-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2328-17-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2328-15-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download