f69a24fc7249f4ae026b6dcf48eb734b45d88e8647a1f84edc25946df1a57011

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/10/2024, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-10-15_08cddab8884f642dfc889c242062c45f_cryptolocker.exe
Size

74KB
MD5

08cddab8884f642dfc889c242062c45f
SHA1

8ea38c4b7f657e615f64015c9d201cda34675595
SHA256

f69a24fc7249f4ae026b6dcf48eb734b45d88e8647a1f84edc25946df1a57011
SHA512

aa1fb57f97069c24c07d41c0f7a2fa5c5a7e06a32ff254749f8a2ba683939791412b43d9805e84acc91f3122fa7f6e40b0eef70ef3b8e28e9f68dc84db7821ec
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4U9HueDgaRWDtJgXkeUTYG0ur:vj+jsMQMOtEvwDpj5H8u8rLXkemJN

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2656	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2856	2024-10-15_08cddab8884f642dfc889c242062c45f_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-15_08cddab8884f642dfc889c242062c45f_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2656	2856	2024-10-15_08cddab8884f642dfc889c242062c45f_cryptolocker.exe	31
PID 2856 wrote to memory of 2656	2856	2024-10-15_08cddab8884f642dfc889c242062c45f_cryptolocker.exe	31
PID 2856 wrote to memory of 2656	2856	2024-10-15_08cddab8884f642dfc889c242062c45f_cryptolocker.exe	31
PID 2856 wrote to memory of 2656	2856	2024-10-15_08cddab8884f642dfc889c242062c45f_cryptolocker.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-10-15_08cddab8884f642dfc889c242062c45f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-15_08cddab8884f642dfc889c242062c45f_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
74KB

MD5
00e9ef5452501b32df77c4cf4eaf95d9

SHA1
16a87d3d08a75df5eda8f36dc7419c0e7933361d

SHA256
86b34e8e615a2a658fe94b30f6b49fa761d94b6ae9e6017aa01e9e88862057d0

SHA512
f26f506c51a9f9ea0578fd66f5333552eec38b2dffe122b051846ecded23574f2903fd6e0ff6e79b2f188246cd052891a752f592f247c584aec61b036a8b55b6

Download Submit
memory/2656-16-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2656-15-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/2856-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2856-1-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2856-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download