d133aea005ec0ca77a3a7fd1e62d32649a6a9d4e4cb902a5a7aa2821d42e5c07

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-12_6c42d6f74058b021cfaf5b5097e28a10_cryptolocker.exe
Size

63KB
MD5

6c42d6f74058b021cfaf5b5097e28a10
SHA1

2f9f44d710bcc69fa1b3c52becfb90a8f36217d6
SHA256

d133aea005ec0ca77a3a7fd1e62d32649a6a9d4e4cb902a5a7aa2821d42e5c07
SHA512

a7cc063c263dc4b4703a9abeaad09f5013b7dee5b1985272fb48b1fd72d85155551453ed0707b2314cae3c83ad0281759657368799b1b4e9eec1f3718aa8b985
SSDEEP

768:3Uz7yVEhs9+Hs1SQtOOtEvwDpjO9+4hdCY8EQMjpi/Wpi3B3URiLqCyLuAx8XG9P:3P+HsMQMOtEvwDpjoHy7B3g9CWuAxWC

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1972	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2668	2024-10-12_6c42d6f74058b021cfaf5b5097e28a10_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-12_6c42d6f74058b021cfaf5b5097e28a10_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 1972	2668	2024-10-12_6c42d6f74058b021cfaf5b5097e28a10_cryptolocker.exe	30
PID 2668 wrote to memory of 1972	2668	2024-10-12_6c42d6f74058b021cfaf5b5097e28a10_cryptolocker.exe	30
PID 2668 wrote to memory of 1972	2668	2024-10-12_6c42d6f74058b021cfaf5b5097e28a10_cryptolocker.exe	30
PID 2668 wrote to memory of 1972	2668	2024-10-12_6c42d6f74058b021cfaf5b5097e28a10_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-10-12_6c42d6f74058b021cfaf5b5097e28a10_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-12_6c42d6f74058b021cfaf5b5097e28a10_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
63KB

MD5
e5a52cc7f67dcdb906627f78cc1b82ae

SHA1
cc080ef00840389fba26d560d4a3ac1803b9c7af

SHA256
41d8b2a908a7f567fc5e2166044f259565e1edcd2490773fbc90317bdb2ed834

SHA512
a0b5d90b64f0278460fc46425bd1c17da27ffa46e85c6420ca322cf3ced53f2136aad24da014f070152ff0ddef033aaa133dae3208d25fa9ca5dea967c432967

Download Submit
memory/1972-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1972-25-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1972-26-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2668-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2668-2-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2668-9-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/2668-1-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/2668-14-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download