cc91f73bb817c5ceaa52ae9462cd5b654c560f7f9275710ff903a4c9a1c272b8

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 03:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-09-09_735f2a599305606de085b905943e4d06_cryptolocker.exe
Size

73KB
MD5

735f2a599305606de085b905943e4d06
SHA1

5f27e29034654e6796e6c8ce8927c7cc6f43fc76
SHA256

cc91f73bb817c5ceaa52ae9462cd5b654c560f7f9275710ff903a4c9a1c272b8
SHA512

377054d07990fa997152727bafc9dc27f7f5aafe5d00e1852dbc228e9b88a41eabe976fdb361ee6bc2224137339946f560e216463641ac5febe2fe543c8f29d4
SSDEEP

1536:nj+4zs2cPVhlMOtEvwDpj4H8u8rZVTs9L/:C4Q2c94OtEvwDpj4H8zW

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2772	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2416	2024-09-09_735f2a599305606de085b905943e4d06_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2416-8-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x000700000001211b-17.dat	upx
behavioral1/memory/2416-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2772-18-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2772-28-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-09_735f2a599305606de085b905943e4d06_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2772	2416	2024-09-09_735f2a599305606de085b905943e4d06_cryptolocker.exe	30
PID 2416 wrote to memory of 2772	2416	2024-09-09_735f2a599305606de085b905943e4d06_cryptolocker.exe	30
PID 2416 wrote to memory of 2772	2416	2024-09-09_735f2a599305606de085b905943e4d06_cryptolocker.exe	30
PID 2416 wrote to memory of 2772	2416	2024-09-09_735f2a599305606de085b905943e4d06_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-09-09_735f2a599305606de085b905943e4d06_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-09_735f2a599305606de085b905943e4d06_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
73KB

MD5
1b2846b665c69d088d333196edfe74f6

SHA1
69b8a621d3ea2ed14f79da183cdf615e043faa54

SHA256
9160757a0fdf8c1ed9489e1f103afff6d3fdf6b11342226b512ca54e2b4f308c

SHA512
a6ec0b6142e55568bf070315dd6cb0d7fea7a663b4a501b5d0406c96e3add05ae13aa524ef2807c4417feec9c9540b4a0439896daeca5dc172ebd124502b1bc6

Download Submit
memory/2416-1-0x0000000000410000-0x0000000000416000-memory.dmp

Filesize
24KB

Download
memory/2416-0-0x00000000003B0000-0x00000000003B6000-memory.dmp

Filesize
24KB

Download
memory/2416-9-0x00000000003B0000-0x00000000003B6000-memory.dmp

Filesize
24KB

Download
memory/2416-8-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2416-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2416-13-0x0000000002840000-0x0000000002850000-memory.dmp

Filesize
64KB

Download
memory/2772-18-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2772-20-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2772-27-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2772-28-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download