6230f81782efabaa04c19841b8a7069ad55491d9ff292edd22d4a722e536d236

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 04:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-11_d7af8da8898dd9f51aa28a53fe46408d_cryptolocker.exe
Size

72KB
MD5

d7af8da8898dd9f51aa28a53fe46408d
SHA1

838f85726c2bb1f94cf671e1447b2c3dca232700
SHA256

6230f81782efabaa04c19841b8a7069ad55491d9ff292edd22d4a722e536d236
SHA512

da756e0ad088f51a981b7daa337d946d44f3f359c27a4338eb63f6d796d9e2dfed7c45196be7d7fb6aa56197711ca4b8c51e1bd43ee80411c04cafcd84d804bc
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4ZPsED3VK2+ZtyOjgO4r9vFAg2rq2g1B/RY:vj+jsMQMOtEvwDpj5HZYTjipvF24A

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2320	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2404	2024-09-11_d7af8da8898dd9f51aa28a53fe46408d_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-11_d7af8da8898dd9f51aa28a53fe46408d_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2320	2404	2024-09-11_d7af8da8898dd9f51aa28a53fe46408d_cryptolocker.exe	30
PID 2404 wrote to memory of 2320	2404	2024-09-11_d7af8da8898dd9f51aa28a53fe46408d_cryptolocker.exe	30
PID 2404 wrote to memory of 2320	2404	2024-09-11_d7af8da8898dd9f51aa28a53fe46408d_cryptolocker.exe	30
PID 2404 wrote to memory of 2320	2404	2024-09-11_d7af8da8898dd9f51aa28a53fe46408d_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-09-11_d7af8da8898dd9f51aa28a53fe46408d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-11_d7af8da8898dd9f51aa28a53fe46408d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
72KB

MD5
c9d3e93f3c00a5c2f1afd77cbc297408

SHA1
f72539a1e4ca842f5bcb745f1d286022904e7d84

SHA256
a5d160a9d4fe4e25a3e0c44aec68f7df61bd4ede9bf00fe2b1146c7a53c5a8e4

SHA512
3c2b747502b1150fe733bfbbf98e8ec8117929133169a5c536865efc9fa85d6d91d89abdc8e85d000b6abbf710b58bed1e2e2bbadd49f7a7e7012a2b15504f96

Download Submit
memory/2320-15-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2320-22-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2404-0-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2404-8-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2404-1-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download