a8095bee73d76a0f98d6c8326ed6e3372c542d62eea3fdb28e680ebd749c4fb6

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-04_80edd8d1e599c56af80b29ac548babac_cryptolocker.exe
Size

38KB
MD5

80edd8d1e599c56af80b29ac548babac
SHA1

1fe522afb5780d0e28e1dccca8c0309d699004e3
SHA256

a8095bee73d76a0f98d6c8326ed6e3372c542d62eea3fdb28e680ebd749c4fb6
SHA512

823f513fe4ddaf08127079f639ad2d80e1baa772d615552993cb9da2bdec6603cc595c2609d0da0bd4cf1c17613c6ab31305eaa285c4445ec9a4dd6a04763164
SSDEEP

768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4C:fT+hsMQMOtEvwDpjoIHC

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2824	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2932	2024-10-04_80edd8d1e599c56af80b29ac548babac_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-04_80edd8d1e599c56af80b29ac548babac_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2824	2932	2024-10-04_80edd8d1e599c56af80b29ac548babac_cryptolocker.exe	30
PID 2932 wrote to memory of 2824	2932	2024-10-04_80edd8d1e599c56af80b29ac548babac_cryptolocker.exe	30
PID 2932 wrote to memory of 2824	2932	2024-10-04_80edd8d1e599c56af80b29ac548babac_cryptolocker.exe	30
PID 2932 wrote to memory of 2824	2932	2024-10-04_80edd8d1e599c56af80b29ac548babac_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-10-04_80edd8d1e599c56af80b29ac548babac_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-04_80edd8d1e599c56af80b29ac548babac_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
38KB

MD5
dd6354072443725aab7be78a3f5aba03

SHA1
c6061b27fd55dafa8c9e9c8ae98015f557eb683b

SHA256
0a2539af787a964dc421016c13901d134a8bbd4f5c500d2a266a8dffe6e04aa3

SHA512
e13d049c78fad687afbe84345da1e370b8290226356181960e6d76e32709ac546af9d2eded39d15315dde141bfce084593dbdea59f6d53d28bd0760eb3ba718e

Download Submit
memory/2824-15-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2824-16-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2932-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2932-1-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2932-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download