Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 04:37
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-09_51022e25e4872bfbaf2013e82624dfbc_cryptolocker.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-09_51022e25e4872bfbaf2013e82624dfbc_cryptolocker.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-09_51022e25e4872bfbaf2013e82624dfbc_cryptolocker.exe
-
Size
53KB
-
MD5
51022e25e4872bfbaf2013e82624dfbc
-
SHA1
4cf76463ac7a6da2526e17f77d7f2c221bb6c0eb
-
SHA256
493225382996fd09e3392fddc3d2d702776e9dcd474c7863c0e98a58a2d11231
-
SHA512
7b43515a83c46c8059c45af73d675965d7b509c418b2b247a1c7bdb03876a16a53859a87585de8eaebee9f8fe73765b3203214293668e1d6b3551c7151c21172
-
SSDEEP
1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJYwo:ZVxkGOtEvwDpjcd
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 856 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 796 2024-10-09_51022e25e4872bfbaf2013e82624dfbc_cryptolocker.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-09_51022e25e4872bfbaf2013e82624dfbc_cryptolocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language misid.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 796 wrote to memory of 856 796 2024-10-09_51022e25e4872bfbaf2013e82624dfbc_cryptolocker.exe 28 PID 796 wrote to memory of 856 796 2024-10-09_51022e25e4872bfbaf2013e82624dfbc_cryptolocker.exe 28 PID 796 wrote to memory of 856 796 2024-10-09_51022e25e4872bfbaf2013e82624dfbc_cryptolocker.exe 28 PID 796 wrote to memory of 856 796 2024-10-09_51022e25e4872bfbaf2013e82624dfbc_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-09_51022e25e4872bfbaf2013e82624dfbc_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-09_51022e25e4872bfbaf2013e82624dfbc_cryptolocker.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:856
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD5bb5c62afde3731852dc84c03570535f2
SHA1e7528600b068b26946641e3776483b12eee8714c
SHA256f6a1039e8af24b0eedf2bbd01c4eb2cbe76af68f92bdd4d0fcc1bfc21f460e11
SHA512db58e52f218848c1f28aa33ca3e999d233bf06a467c5d54c13353bfaad64c11119c39e873be98e4e3d669054ac463c88aabe9ee43ab5cb90858b5b71d6168419