d8dc772717901ed3c6062715a27a69bc9224f836e702b7eca224316b1423d1ba

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 03:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-12_17ff3fbefdf74bb37db7cdb24b05138d_cryptolocker.exe
Size

36KB
MD5

17ff3fbefdf74bb37db7cdb24b05138d
SHA1

445f3e91044a1809c93b76d0f7b45ce0508c459c
SHA256

d8dc772717901ed3c6062715a27a69bc9224f836e702b7eca224316b1423d1ba
SHA512

a4633b322d49aa0ad1c56ed9efeb9539d52e86de75b6a4d7ae0045f4855779ed4aad1aac853883e17e92a4b5dc8c1243888a2c2649f9ba704b32ca7dbb405d0f
SSDEEP

768:XS5nQJ24LR1bytOOtEvwDpj66BLbjG9RzF:i5nkFGMOtEvwDpjR+J

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2360	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2236	2024-10-12_17ff3fbefdf74bb37db7cdb24b05138d_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-12_17ff3fbefdf74bb37db7cdb24b05138d_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2360	2236	2024-10-12_17ff3fbefdf74bb37db7cdb24b05138d_cryptolocker.exe	30
PID 2236 wrote to memory of 2360	2236	2024-10-12_17ff3fbefdf74bb37db7cdb24b05138d_cryptolocker.exe	30
PID 2236 wrote to memory of 2360	2236	2024-10-12_17ff3fbefdf74bb37db7cdb24b05138d_cryptolocker.exe	30
PID 2236 wrote to memory of 2360	2236	2024-10-12_17ff3fbefdf74bb37db7cdb24b05138d_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-10-12_17ff3fbefdf74bb37db7cdb24b05138d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-12_17ff3fbefdf74bb37db7cdb24b05138d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
37KB

MD5
bfb3cf94aa848cda7e6a6f7811f7f7d3

SHA1
c5c158752e49625399ec2fe4a1eb50036fb6efd4

SHA256
61f3febe424d092bb02ebdb69c946deb4d1cd77e4dcb131dc9d4f5d45d5ed10b

SHA512
5d9104f675430cd1574312a349f7498612130a0cd3020cb4a5d45b690e33286337067d3ee67250cb57c4ba2302595c28679c3fbcb14b8cc176c9ec6a548c157a

Download Submit
memory/2236-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2236-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2236-2-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2236-3-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2236-13-0x0000000000640000-0x000000000064F000-memory.dmp

Filesize
60KB

Download
memory/2236-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2360-18-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2360-20-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2360-27-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2360-28-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download