647306a2da7ec464401629cd5bb6fce4db359bf9335d9f33309e3a5ad8a37287

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-09-06_3477b07c56cd2c036441c6a03ac68d00_cryptolocker.exe
Size

46KB
MD5

3477b07c56cd2c036441c6a03ac68d00
SHA1

a6e910491899272e5b9f4c3a54173fb25d977fe7
SHA256

647306a2da7ec464401629cd5bb6fce4db359bf9335d9f33309e3a5ad8a37287
SHA512

7bb853a32bb5ea9cbd511e436bac875f24d024e3fabd3249abeea5d6bae64e224c7202c97f151bfe460da50ab5efa2b4c05fb0e9455a45a235d32c373f15e970
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/aMDhkJ+:6j+1NMOtEvwDpjrRraJ+

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1136	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
3052	2024-09-06_3477b07c56cd2c036441c6a03ac68d00_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-06_3477b07c56cd2c036441c6a03ac68d00_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 1136	3052	2024-09-06_3477b07c56cd2c036441c6a03ac68d00_cryptolocker.exe	30
PID 3052 wrote to memory of 1136	3052	2024-09-06_3477b07c56cd2c036441c6a03ac68d00_cryptolocker.exe	30
PID 3052 wrote to memory of 1136	3052	2024-09-06_3477b07c56cd2c036441c6a03ac68d00_cryptolocker.exe	30
PID 3052 wrote to memory of 1136	3052	2024-09-06_3477b07c56cd2c036441c6a03ac68d00_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-09-06_3477b07c56cd2c036441c6a03ac68d00_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-06_3477b07c56cd2c036441c6a03ac68d00_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
46KB

MD5
4682cfce869475d5faae33c390eeaaaf

SHA1
35f61b99cb4f4af60099334c43a8fe5ba8fc2cce

SHA256
a9698a65216826c24ec086287f547165635b694f573ed367b1d0c630b0db9164

SHA512
4fb12bfa667204dcd0d8ca0fc10ada5b397568ac668bbd43785f48d12c317e97318cdcde5915f7f6aec4e63d36825eb21a0ab7b9091e386645521d0ea8a14538

Download Submit
memory/1136-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1136-18-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/1136-25-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/1136-26-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3052-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3052-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3052-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3052-2-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/3052-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download