3f591b10c373395352c1fff1b41151763bb62a7443e7997125becde05151cacb

Analysis

max time kernel
144s
max time network
155s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-27_81a0ac62e5debcc7ffa9953cc156a663_cryptolocker.exe
Size

33KB
MD5

81a0ac62e5debcc7ffa9953cc156a663
SHA1

581a8649e28be30749322888351519d64ff52477
SHA256

3f591b10c373395352c1fff1b41151763bb62a7443e7997125becde05151cacb
SHA512

5e640a88c4430e252d6d171bea149b1406c00337b8ee97f7bd73e5a50103f4bb692a41af8ff2f75dc1cdf2ffcc8783996441a4f107cb4f1991d437a69bbb1dfc
SSDEEP

384:+cX+ni9VCr5nQI021q4VQBqURYpetOOtEvwDpjqIGRxzOP51FqQLicn3f3E:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2328	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2512	2024-09-27_81a0ac62e5debcc7ffa9953cc156a663_cryptolocker.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-27_81a0ac62e5debcc7ffa9953cc156a663_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2328	2512	2024-09-27_81a0ac62e5debcc7ffa9953cc156a663_cryptolocker.exe	30
PID 2512 wrote to memory of 2328	2512	2024-09-27_81a0ac62e5debcc7ffa9953cc156a663_cryptolocker.exe	30
PID 2512 wrote to memory of 2328	2512	2024-09-27_81a0ac62e5debcc7ffa9953cc156a663_cryptolocker.exe	30
PID 2512 wrote to memory of 2328	2512	2024-09-27_81a0ac62e5debcc7ffa9953cc156a663_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-09-27_81a0ac62e5debcc7ffa9953cc156a663_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-27_81a0ac62e5debcc7ffa9953cc156a663_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
33KB

MD5
f201493803b30fdc7db679a37cc4d3e4

SHA1
83ccd2a27ccf87ab572502c02020ee0d7cceb471

SHA256
98cd0d345151bc97edf5779d8c0ddf97c2fc3cc1187058a9b8ec6dd52f6ff23e

SHA512
a2c5be3c86524cd0e37d1a625176e8c724232145a3e66665515ff937beec65a6a56eda04d74206d8d7f4bc7f7abffc583f03d4ea223f77ee807c5e9c294c1605

Download Submit
memory/2328-17-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2328-19-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download
memory/2328-26-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2512-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2512-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2512-3-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2512-2-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2512-15-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download