c4cc198380137b816c742f4b25d77dfd4da81c27c1a4ee3d5aae7ece6a225ae0

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 08:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-05_862dd068f734833e0dc0a7686d3d52fd_cryptolocker.exe
Size

53KB
MD5

862dd068f734833e0dc0a7686d3d52fd
SHA1

8aaae1607627c7fd029c4ccdb2c96a2d85523358
SHA256

c4cc198380137b816c742f4b25d77dfd4da81c27c1a4ee3d5aae7ece6a225ae0
SHA512

595a2e713382080843e777719a716ad03aeb2406f6ce2a478ee153209e1b224ed8ef5dbf71543ede211f31eb2fa722af36378d7353fd60ddf671a34d6efc1121
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrr42A7n0FmB0ntbcl:vj+jsMQMOtEvwDpj5HczerLO04BGcl

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3060	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
876	2024-10-05_862dd068f734833e0dc0a7686d3d52fd_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-05_862dd068f734833e0dc0a7686d3d52fd_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 3060	876	2024-10-05_862dd068f734833e0dc0a7686d3d52fd_cryptolocker.exe	31
PID 876 wrote to memory of 3060	876	2024-10-05_862dd068f734833e0dc0a7686d3d52fd_cryptolocker.exe	31
PID 876 wrote to memory of 3060	876	2024-10-05_862dd068f734833e0dc0a7686d3d52fd_cryptolocker.exe	31
PID 876 wrote to memory of 3060	876	2024-10-05_862dd068f734833e0dc0a7686d3d52fd_cryptolocker.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-10-05_862dd068f734833e0dc0a7686d3d52fd_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-05_862dd068f734833e0dc0a7686d3d52fd_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:876
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
53KB

MD5
e3b35555e289a577038362e7a3602f7d

SHA1
7c371e4d32b28fda357cb8f8174cefa8dfa1b7f5

SHA256
0c1a59011b45c04fc392fea8748a57e11198e52e7299821b87c7a723995f1df1

SHA512
2563731aa98cd43545ca41a623520b65dcb2c7551a4155a4304b64a4e5ed1df35d30a32757ff93be54eefcf126ba1bbcdb74bb34097a10ddb167a62b0ce68065

Download Submit
memory/876-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/876-1-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/876-7-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/3060-15-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3060-16-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download