716d30dd5a0e202b09465dea985f637894f2c8b67a600ba1562c85e6a7642ac8

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 05:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-09-19_7d92b18784b5790b89b76fa04ed13e0b_cryptolocker.exe
Size

47KB
MD5

7d92b18784b5790b89b76fa04ed13e0b
SHA1

ebaffc99abfab8ea89bc0d9d4144c0a404eb98f8
SHA256

716d30dd5a0e202b09465dea985f637894f2c8b67a600ba1562c85e6a7642ac8
SHA512

559f077411f7ba73ebe4cd2dd131f8032e14f49b1c70d1f4ab3ab46a808095ef3bb33b87e6c291b8b6d2c2d1a308f2a7b173a9abc1928a9d19d73ae8f029886e
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLtldeddKyYWQ:xj+VGMOtEvwDpjk/e/E

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2088	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2068	2024-09-19_7d92b18784b5790b89b76fa04ed13e0b_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-19_7d92b18784b5790b89b76fa04ed13e0b_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2088	2068	2024-09-19_7d92b18784b5790b89b76fa04ed13e0b_cryptolocker.exe	30
PID 2068 wrote to memory of 2088	2068	2024-09-19_7d92b18784b5790b89b76fa04ed13e0b_cryptolocker.exe	30
PID 2068 wrote to memory of 2088	2068	2024-09-19_7d92b18784b5790b89b76fa04ed13e0b_cryptolocker.exe	30
PID 2068 wrote to memory of 2088	2068	2024-09-19_7d92b18784b5790b89b76fa04ed13e0b_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-09-19_7d92b18784b5790b89b76fa04ed13e0b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-19_7d92b18784b5790b89b76fa04ed13e0b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
47KB

MD5
a75f7e5037a99a122a341d0bac866026

SHA1
67f38dbe916f4f103526babd06c3d9a6b223b357

SHA256
7e308bc983c5064637792439e1dfcb8d314dcb6d0ee0ed073d36a66b7714cafb

SHA512
e4f6acc0a605684eb8b3f0af1ddd25aa41c0ad069ce93de3417116774be6b33180c9031d5fd30f96cbd09db531c1bb8f3b3e80fa2d582b9f5e84b7ad3b484b0a

Download Submit
memory/2068-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2068-2-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2068-9-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2068-1-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2068-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2088-24-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2088-17-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2088-25-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download