4fe30595969da91d231d9bc507e5c56e21ab78e46b5aafc97ad77df823930f4a

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 05:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-10-10_bb2f4098cc6b89313d227cae0e9af0c8_cryptolocker.exe
Size

74KB
MD5

bb2f4098cc6b89313d227cae0e9af0c8
SHA1

59a4c85e65e87baa4e4e079b6e3a1380f9e1d304
SHA256

4fe30595969da91d231d9bc507e5c56e21ab78e46b5aafc97ad77df823930f4a
SHA512

8992be34326c73b79da6f16cfa15f7e481d445bd6b39e6f13877f4e047fb44b190075f4f9ac6149270bad2b2e7b25ad55a11516bfdc04fb7682db5169509aad6
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4U9HueDgaRWDtJgXkeUTYG0C:vj+jsMQMOtEvwDpj5H8u8rLXkemJ9

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2436	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2080	2024-10-10_bb2f4098cc6b89313d227cae0e9af0c8_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-10_bb2f4098cc6b89313d227cae0e9af0c8_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2436	2080	2024-10-10_bb2f4098cc6b89313d227cae0e9af0c8_cryptolocker.exe	30
PID 2080 wrote to memory of 2436	2080	2024-10-10_bb2f4098cc6b89313d227cae0e9af0c8_cryptolocker.exe	30
PID 2080 wrote to memory of 2436	2080	2024-10-10_bb2f4098cc6b89313d227cae0e9af0c8_cryptolocker.exe	30
PID 2080 wrote to memory of 2436	2080	2024-10-10_bb2f4098cc6b89313d227cae0e9af0c8_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-10-10_bb2f4098cc6b89313d227cae0e9af0c8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-10_bb2f4098cc6b89313d227cae0e9af0c8_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
74KB

MD5
f7917eac4ce4eeddde29c47ba186a9b9

SHA1
ca8ab766d3b81c9a37be31489607a4687b631543

SHA256
23d2986858075a1f640705572c808389ece32a76dd5e343480ff6010525ce6c0

SHA512
e3fd2baf8c5807bf9b18b16deac5aaee9734a5a781839756a3d41021ad50a13975cb5eb1ea11a27f8d5ccc1b91f0168fe7f2e685fd780658bdf6fd502c2f8958

Download Submit
memory/2080-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2080-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2080-1-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2436-16-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2436-15-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download