5e6e5c7baf744b9efe9453aee48ee651e76ca12ab465064dd62728b78963e5c7

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-10-2024 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-06_2ff501ae2f3b7a06761b7cbac8726a13_cryptolocker.exe
Size

53KB
MD5

2ff501ae2f3b7a06761b7cbac8726a13
SHA1

66d2190b7ab92543ecaac870f9b355ef280b7069
SHA256

5e6e5c7baf744b9efe9453aee48ee651e76ca12ab465064dd62728b78963e5c7
SHA512

5b95d17b831cb64f312b55ec4c27c4dafc1da27aa21732540ee9f522c4ed0e4b76ceb34e8ffe0c07119c874ea5b2cbd0acaedc8c5d8b959aedc0c25b5d6849ee
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4hdCW1nw71TkhsiPn1YFvP0l:vj+jsMQMOtEvwDpj5HH1nw73KOFy

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3036	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1876	2024-10-06_2ff501ae2f3b7a06761b7cbac8726a13_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-06_2ff501ae2f3b7a06761b7cbac8726a13_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 3036	1876	2024-10-06_2ff501ae2f3b7a06761b7cbac8726a13_cryptolocker.exe	28
PID 1876 wrote to memory of 3036	1876	2024-10-06_2ff501ae2f3b7a06761b7cbac8726a13_cryptolocker.exe	28
PID 1876 wrote to memory of 3036	1876	2024-10-06_2ff501ae2f3b7a06761b7cbac8726a13_cryptolocker.exe	28
PID 1876 wrote to memory of 3036	1876	2024-10-06_2ff501ae2f3b7a06761b7cbac8726a13_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-10-06_2ff501ae2f3b7a06761b7cbac8726a13_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-06_2ff501ae2f3b7a06761b7cbac8726a13_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
54KB

MD5
51fb87ccdce06be666afcc3ad7f70cd6

SHA1
63b380f592cae1d3cb2a5d120467f05289fc0d03

SHA256
dd52dfe6d769810ed3a1a5e4512f30da7e7af3591f8b29619e8c7ccac5bc44cf

SHA512
c186eeab1b454ad03c248d42a340b5facffa2f5d87e3baab88099268654bce1271a223d35abca8f06d1024ad9e3cbc8dc19f26fc5ec5562fbb06d91fb6ae745c

Download Submit
memory/1876-8-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1876-1-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/1876-0-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/3036-22-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3036-15-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download