Analysis

  • max time kernel
    141s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    10/10/2024, 09:26

General

  • Target

    2024-10-10_612f521ec70b519cf102a3ba852f543a_cryptolocker.exe

  • Size

    71KB

  • MD5

    612f521ec70b519cf102a3ba852f543a

  • SHA1

    09072604010a27c438aa29ecba75bb368bab3966

  • SHA256

    35b1b0823e65adc04f28d148967272517a950dc1c29f74d4ddd37d4415eca07f

  • SHA512

    045256ffdef47548812f4ad370ccf9a1c3710259227bad5a00e2f4ec7ce58088da1f6330b158a15a76647a46949a24f0dd9b931ff84b803b6dcd10e517256e58

  • SSDEEP

    768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8z2iaSIO/RvDQeduJHqqnzvNGs/:ZzFbxmLPWQMOtEvwDpj386Sj/RsxB

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-10_612f521ec70b519cf102a3ba852f543a_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-10_612f521ec70b519cf102a3ba852f543a_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1948
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2420

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    71KB

    MD5

    1def1d8d801956735801923d151ed691

    SHA1

    cc8293b261a2925bdd899764d8444b66d4e1b781

    SHA256

    6f50bfc7bc03da85d8344ca5d76ee02d4277edccd75950481d44515872af1312

    SHA512

    5b5353f942377fb6434605c4aaef9d655028a2c92ac6177d681ec54e1e2b767fed241d66fdc32a66ab258177910774f88481dfc1bb331475ca828efaf96e8ea6

  • memory/1948-0-0x00000000003B0000-0x00000000003B3000-memory.dmp

    Filesize

    12KB

  • memory/1948-2-0x00000000004C0000-0x00000000004C6000-memory.dmp

    Filesize

    24KB

  • memory/1948-1-0x0000000000480000-0x0000000000486000-memory.dmp

    Filesize

    24KB

  • memory/1948-9-0x0000000000480000-0x0000000000486000-memory.dmp

    Filesize

    24KB

  • memory/2420-15-0x0000000000230000-0x0000000000233000-memory.dmp

    Filesize

    12KB

  • memory/2420-17-0x0000000000310000-0x0000000000316000-memory.dmp

    Filesize

    24KB

  • memory/2420-24-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB