a51bb0ba2e1fc2049d4cd6b477261b73e9799072299e1e259700691fa86d065e

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-10-10_7d08f08bd17c9445166667c0099f08d8_cryptolocker.exe
Size

51KB
MD5

7d08f08bd17c9445166667c0099f08d8
SHA1

022c8dbf950d9cac0825c455565d29bf87d29b75
SHA256

a51bb0ba2e1fc2049d4cd6b477261b73e9799072299e1e259700691fa86d065e
SHA512

aa39936effb02719409c0b8ee3a139ae84543d0c320616dba7d33497eb0bb7fdd91775d180f7e83edbc7a6bb9543f223eff65906ddaaf7fb68a26cfcbd07eb6e
SSDEEP

768:XS5nQJ24LR1bytOOtEvwDpjNbP/0Gehm+:i5nkFGMOtEvwDpjNbXdec+

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1704	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2568	2024-10-10_7d08f08bd17c9445166667c0099f08d8_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-10_7d08f08bd17c9445166667c0099f08d8_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 1704	2568	2024-10-10_7d08f08bd17c9445166667c0099f08d8_cryptolocker.exe	30
PID 2568 wrote to memory of 1704	2568	2024-10-10_7d08f08bd17c9445166667c0099f08d8_cryptolocker.exe	30
PID 2568 wrote to memory of 1704	2568	2024-10-10_7d08f08bd17c9445166667c0099f08d8_cryptolocker.exe	30
PID 2568 wrote to memory of 1704	2568	2024-10-10_7d08f08bd17c9445166667c0099f08d8_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-10-10_7d08f08bd17c9445166667c0099f08d8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-10_7d08f08bd17c9445166667c0099f08d8_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
51KB

MD5
63c2ecdf776e3c26e9ecbf75d387b664

SHA1
f1eb71be941d6fcbfcc78bb1901d5fad15581628

SHA256
f76d050f0afb3a3501d1e2a8932019f29511a874752e618770ec5b306a379f13

SHA512
6c961a273319b1c84ece5bbbef8133f13e6acc32fa2d8c2a900bad3175ac14bbd8d4a710f44033a2cb128bb6b1dc9f3ab64b292cb994edff9dd643cb992fd08b

Download Submit
memory/1704-18-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/1704-25-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/1704-26-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2568-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2568-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2568-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2568-2-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2568-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download