8c65a18f8fc63fc3c2544152cfc622b2c04223420afa82fbff67c027e3746612

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 06:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-01_9f167e1e1485f3c94e66c8c2a5c1095b_cryptolocker.exe
Size

47KB
MD5

9f167e1e1485f3c94e66c8c2a5c1095b
SHA1

2c35c8b8fb6b744321daf924917fcb6b1de6d628
SHA256

8c65a18f8fc63fc3c2544152cfc622b2c04223420afa82fbff67c027e3746612
SHA512

90ccdcd35648923efaec6e3e819409955e8ef1e7c4d72595daa85c5f0e1a2ce1d88b32f18e38d2c1d34974a11385d9bf539cd60b42fad74c323497132c9703da
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/aMDhkJlai:6j+1NMOtEvwDpjrRraJgi

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2384	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2756	2024-10-01_9f167e1e1485f3c94e66c8c2a5c1095b_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-01_9f167e1e1485f3c94e66c8c2a5c1095b_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2384	2756	2024-10-01_9f167e1e1485f3c94e66c8c2a5c1095b_cryptolocker.exe	30
PID 2756 wrote to memory of 2384	2756	2024-10-01_9f167e1e1485f3c94e66c8c2a5c1095b_cryptolocker.exe	30
PID 2756 wrote to memory of 2384	2756	2024-10-01_9f167e1e1485f3c94e66c8c2a5c1095b_cryptolocker.exe	30
PID 2756 wrote to memory of 2384	2756	2024-10-01_9f167e1e1485f3c94e66c8c2a5c1095b_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-10-01_9f167e1e1485f3c94e66c8c2a5c1095b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-01_9f167e1e1485f3c94e66c8c2a5c1095b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
47KB

MD5
1c2a31a742929580e4f5c231e5a08924

SHA1
42e6083c95c2c036cfe3e6241186afa674bfc24e

SHA256
624dd65cc08cc0af1bcae31b667121def1f6b3018afb53979d8b3ebeba40b2b1

SHA512
f0ab1051f9fa15a7e48eb217b182b3cce2f65a22265b4c164a63ebba983968fcf22cd31a4460f7a3dcb6062506efd8ca90ca33faca43b19dd1151ee3dbfc41b7

Download Submit
memory/2384-17-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2384-24-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2384-25-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2756-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2756-2-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download
memory/2756-1-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2756-9-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2756-14-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download