febcb3b5311a6526f0b9da2d4b0815ba67a5df871f7e474b4223d9dae60f0f24

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-27_65c33a60ca808aedf2e34075839b78d4_cryptolocker.exe
Size

788KB
MD5

65c33a60ca808aedf2e34075839b78d4
SHA1

7714ec9c03c62ec48adac12def9297ff16179150
SHA256

febcb3b5311a6526f0b9da2d4b0815ba67a5df871f7e474b4223d9dae60f0f24
SHA512

64580972d588d5f788828f0346e6bebe458b359b87f7fe37634cc220c386eafe4c9949fe3db87eab61cb1a8258f1690caf818932e940889289975a69da6b1d67
SSDEEP

24576:aHQVCB9lVF1lVF1lVFkUEi019za5F+DLK9bygw6X/pZ:aHAg9lVF1lVF1lVFkUEiiCX/z

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2776	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2280	2024-09-27_65c33a60ca808aedf2e34075839b78d4_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-27_65c33a60ca808aedf2e34075839b78d4_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2776	2280	2024-09-27_65c33a60ca808aedf2e34075839b78d4_cryptolocker.exe	31
PID 2280 wrote to memory of 2776	2280	2024-09-27_65c33a60ca808aedf2e34075839b78d4_cryptolocker.exe	31
PID 2280 wrote to memory of 2776	2280	2024-09-27_65c33a60ca808aedf2e34075839b78d4_cryptolocker.exe	31
PID 2280 wrote to memory of 2776	2280	2024-09-27_65c33a60ca808aedf2e34075839b78d4_cryptolocker.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-09-27_65c33a60ca808aedf2e34075839b78d4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-27_65c33a60ca808aedf2e34075839b78d4_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
788KB

MD5
7f6b1061b823cb40a5523311ac2f5e2c

SHA1
a497a60cb7faa582a0cc6e1139802a6918f35b75

SHA256
d039816f08f05c2e098460b854165a1314d96a258c33410eaf4b3c392ae26bd1

SHA512
118b9a6b778d683d8b147c60876d8ca11e7900a662fc33b804acaa34aa39d31530c7e00d0bf4a93b0425db8fb116fdee873ec6a0096f7edc95d175265bb1fe3d

Download Submit
memory/2280-0-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/2280-1-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2280-8-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/2776-15-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download