f56d1af264d220ae6bde4f7a2fcf0538effceafbe0cd5d19e3a61b1f9f87a6d4

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/10/2024, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-10-06_b2fa53dc8eec7578931948db4228d6e3_cryptolocker.exe
Size

96KB
MD5

b2fa53dc8eec7578931948db4228d6e3
SHA1

ea0a2cd2cfac398a8ccd121f504c06c3341e3117
SHA256

f56d1af264d220ae6bde4f7a2fcf0538effceafbe0cd5d19e3a61b1f9f87a6d4
SHA512

9cafe5fb28a70b842ef94d9d4d18a19ab5dc888c822b79d932e77d8c892b2723038f41ab76435e232c044f843b7570c6d996db86e11fef2b68ccd06283a085e5
SSDEEP

768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRiWjzs:i5nkFGMOtEvwDpjNbwQEIikQ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2480	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2308	2024-10-06_b2fa53dc8eec7578931948db4228d6e3_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-06_b2fa53dc8eec7578931948db4228d6e3_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2480	2308	2024-10-06_b2fa53dc8eec7578931948db4228d6e3_cryptolocker.exe	31
PID 2308 wrote to memory of 2480	2308	2024-10-06_b2fa53dc8eec7578931948db4228d6e3_cryptolocker.exe	31
PID 2308 wrote to memory of 2480	2308	2024-10-06_b2fa53dc8eec7578931948db4228d6e3_cryptolocker.exe	31
PID 2308 wrote to memory of 2480	2308	2024-10-06_b2fa53dc8eec7578931948db4228d6e3_cryptolocker.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-10-06_b2fa53dc8eec7578931948db4228d6e3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-06_b2fa53dc8eec7578931948db4228d6e3_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
97KB

MD5
c79a3b70baaae3acdd9acf2eead7d887

SHA1
9aaa12da8acc3cf3043ac05d9ad4b71807e7f900

SHA256
8a358847f4013d30ff6c72970be4c3d9022f70152654678e74fbae819f1d39d5

SHA512
3158728e71a65e1731a36fb19a891d273d999dbaf77d499964c5a1c675c7a39672014297a323280749a5fa55cf8e335b5c259f25acd60381955069139aac5fed

Download Submit
memory/2308-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2308-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2308-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2308-2-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2308-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2480-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2480-19-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2480-26-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2480-27-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download