9e5c843ecce096635d43268768ea34a5d82becb965bf07097e7fd005d75e70f0

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-13_db3bd8df5a6de833f7a505f39252678b_cryptolocker.exe
Size

38KB
MD5

db3bd8df5a6de833f7a505f39252678b
SHA1

67802bac0fbb330572db010c145cd7aa70c61add
SHA256

9e5c843ecce096635d43268768ea34a5d82becb965bf07097e7fd005d75e70f0
SHA512

a7187b8d4638740513410a72d1b8fd4035a8ba23e5c4389ce685857792fd10cf378025d4175a64167e38d34f7622b32281e8d46b27cedd5b0a97bd4845b5bca2
SSDEEP

768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4XYNN:fT+hsMQMOtEvwDpjoIHIn

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2672	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2132	2024-09-13_db3bd8df5a6de833f7a505f39252678b_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-13_db3bd8df5a6de833f7a505f39252678b_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2672	2132	2024-09-13_db3bd8df5a6de833f7a505f39252678b_cryptolocker.exe	28
PID 2132 wrote to memory of 2672	2132	2024-09-13_db3bd8df5a6de833f7a505f39252678b_cryptolocker.exe	28
PID 2132 wrote to memory of 2672	2132	2024-09-13_db3bd8df5a6de833f7a505f39252678b_cryptolocker.exe	28
PID 2132 wrote to memory of 2672	2132	2024-09-13_db3bd8df5a6de833f7a505f39252678b_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-09-13_db3bd8df5a6de833f7a505f39252678b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-13_db3bd8df5a6de833f7a505f39252678b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
38KB

MD5
5d16b665924dada92a6bb2450b5977a0

SHA1
d5599d45cf9fd4847d702bde41c52b8e7fdbbe04

SHA256
ff85aadd9d7f99e2b31804189118725c823ab04e4a66e4a357de3f2722386580

SHA512
3c518d488778b0a8d22be2b1180063ee214dc895356553d7f293716d7996b282cc68101ae0107372f2fe4f6c6b3b873fb5433b64b0ea423db7730ed65ffd2c51

Download Submit
memory/2132-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2132-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2132-2-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/2672-15-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2672-22-0x00000000003A0000-0x00000000003A6000-memory.dmp

Filesize
24KB

Download