5e342deb16fec5db3a9d6e434653ba2dafb9e21bb2d56dfeff49e3d774343a28

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 02:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-10-02_04ee8b6c1c7e58d1053a07b6ca21438a_cryptolocker.exe
Size

86KB
MD5

04ee8b6c1c7e58d1053a07b6ca21438a
SHA1

1e236701a2aba4b43966f8055946cabf1abe63c3
SHA256

5e342deb16fec5db3a9d6e434653ba2dafb9e21bb2d56dfeff49e3d774343a28
SHA512

49ad092f9e75f3f68a54e85d1b6925342b0bb910a5d51bc21c96c00cfdfa7a5b396c7057659c213c83180675fa602953bf15c21ad53278b26d72b5a8ad7c5795
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMrCsI:TCjsIOtEvwDpj5HE/OUHnSMk

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1820	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2436	2024-10-02_04ee8b6c1c7e58d1053a07b6ca21438a_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-02_04ee8b6c1c7e58d1053a07b6ca21438a_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1820	2436	2024-10-02_04ee8b6c1c7e58d1053a07b6ca21438a_cryptolocker.exe	30
PID 2436 wrote to memory of 1820	2436	2024-10-02_04ee8b6c1c7e58d1053a07b6ca21438a_cryptolocker.exe	30
PID 2436 wrote to memory of 1820	2436	2024-10-02_04ee8b6c1c7e58d1053a07b6ca21438a_cryptolocker.exe	30
PID 2436 wrote to memory of 1820	2436	2024-10-02_04ee8b6c1c7e58d1053a07b6ca21438a_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-10-02_04ee8b6c1c7e58d1053a07b6ca21438a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-02_04ee8b6c1c7e58d1053a07b6ca21438a_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
86KB

MD5
c3020d6464ed27ad2635853ad06bdcf8

SHA1
840ce92591e81a3655a0cff70e71542f0fd2c083

SHA256
03db36ca0b760f8b1d95e4a0f4f47e3efd051f3ee6ac7355b95c481db4c6e78b

SHA512
99303c9d6053dd6f4b88a579ea960e0936c2c7dc6ad9c787baea7ba125b14efac20a07f76d6b2281ddbb68db50e28759b838cb77170818cfd1e24ff6ffa30433

Download Submit
memory/1820-16-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/1820-18-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/1820-25-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1820-26-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2436-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2436-1-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2436-2-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2436-3-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/2436-15-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download