a9a812ddb6c5e1c2283305eaa82d5e055373a1ad5e614e0c4f5b855185d5a71c

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 07:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-01_593da47a94157c7d8b212ca6907278ed_cryptolocker.exe
Size

31KB
MD5

593da47a94157c7d8b212ca6907278ed
SHA1

96503bf64d66d019546fb1a4c970edc58e10aeac
SHA256

a9a812ddb6c5e1c2283305eaa82d5e055373a1ad5e614e0c4f5b855185d5a71c
SHA512

27e766a2466c574192aa8d0e551b4232fd1e19c2530f84c9908e74e826a89a5fed75190ae34d780e06386e8220e5c1613dfba7456664040cd64249ce488a299d
SSDEEP

384:v0VkMq01bJ3wtEwPS8HLEh+Jagz+3be+26Rsn1rCcOQtOOtEvwDpjqIGRS/Vb9h/:vQz7yVEhs9+js1SQtOOtEvwDpjz9+9A

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2616	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2656	2024-10-01_593da47a94157c7d8b212ca6907278ed_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-01_593da47a94157c7d8b212ca6907278ed_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2616	2656	2024-10-01_593da47a94157c7d8b212ca6907278ed_cryptolocker.exe	28
PID 2656 wrote to memory of 2616	2656	2024-10-01_593da47a94157c7d8b212ca6907278ed_cryptolocker.exe	28
PID 2656 wrote to memory of 2616	2656	2024-10-01_593da47a94157c7d8b212ca6907278ed_cryptolocker.exe	28
PID 2656 wrote to memory of 2616	2656	2024-10-01_593da47a94157c7d8b212ca6907278ed_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-10-01_593da47a94157c7d8b212ca6907278ed_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-01_593da47a94157c7d8b212ca6907278ed_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
31KB

MD5
23a92b841cffcc1130f0a112178cce04

SHA1
d89e1e2c1cbd43e702ffe6b584039f1d6fbe0602

SHA256
b0689ae82d71c89ad2f8623316c0c8758eacaca8ff99350725efd0801c787a44

SHA512
250c2bef5bdc0faa6b972ea5634384d1f38ae0078032a03b935a8c1761e67d4baf863be3dfdff489051703bc3d0daf40e5c54e9ca2e7a874c8d8943673e272de

Download Submit
memory/2616-15-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2616-22-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2656-0-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2656-2-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2656-8-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download