d25e7229a083ae2cd02a6ff2d44c0f599887c0498a9140c18da2f3cda093b528

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-14_ee23834950253a12162b781d89f4a3ca_cryptolocker.exe
Size

50KB
MD5

ee23834950253a12162b781d89f4a3ca
SHA1

cb24ed869ca34179650144382e015751d3b788f6
SHA256

d25e7229a083ae2cd02a6ff2d44c0f599887c0498a9140c18da2f3cda093b528
SHA512

735d61892ad7fb7c5b0b434b06f0c6b3c75fd144bcee3a91bae738669207ea498d4f6622c47153084f18b4c25f558de753c5a0097111e48a72f1721663680fb7
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9RzhwaN4NO2Bjjtx:xj+VGMOtEvwDpjy+TN41jH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1476	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1800	2024-10-14_ee23834950253a12162b781d89f4a3ca_cryptolocker.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-14_ee23834950253a12162b781d89f4a3ca_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1476	1800	2024-10-14_ee23834950253a12162b781d89f4a3ca_cryptolocker.exe	30
PID 1800 wrote to memory of 1476	1800	2024-10-14_ee23834950253a12162b781d89f4a3ca_cryptolocker.exe	30
PID 1800 wrote to memory of 1476	1800	2024-10-14_ee23834950253a12162b781d89f4a3ca_cryptolocker.exe	30
PID 1800 wrote to memory of 1476	1800	2024-10-14_ee23834950253a12162b781d89f4a3ca_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-10-14_ee23834950253a12162b781d89f4a3ca_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-14_ee23834950253a12162b781d89f4a3ca_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
50KB

MD5
b48c0ce9c37c22b076077c98f719d9b9

SHA1
7112064407c07288de1cbb60dcb2f94cd517b81f

SHA256
5c3f3da17341fd3ba834770b51c3d1493ba51de312ade104ea63e5439fb3fd62

SHA512
6779a49d2181bae902046b878bae4fb994e9edadf699531fbe305d65639209b2ce422885fe9a5477e8e95e9c400d9cc815d55d5d683f737beb283184fd6eacf7

Download Submit
memory/1476-24-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/1476-17-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/1476-25-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1800-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1800-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1800-2-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/1800-9-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1800-14-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download