b788e1d731093b237cdeb283412377e3e29840f93ec37b458b13b43f64008252

Analysis

max time kernel
145s
max time network
154s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-17_334feceeb5e88725ca39b198b5aa53e8_cryptolocker.exe
Size

55KB
MD5

334feceeb5e88725ca39b198b5aa53e8
SHA1

d261ae7c82234188c92034a6144e34880bd3de0c
SHA256

b788e1d731093b237cdeb283412377e3e29840f93ec37b458b13b43f64008252
SHA512

7cb8f4693dc580aeb1dcf440f768f0ee90bd1728e27e00075af1263ee4818f0d073c7c0de2b9bd1fc398ee6deb647b27cf151ac37371e997c533d6415fe1532f
SSDEEP

768:zQz7yVEhs9+syJP6ntOOtEvwDpjFeV0ZOfcpLx:zj+soPSMOtEvwDpj4yx

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1984	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1620	2024-10-17_334feceeb5e88725ca39b198b5aa53e8_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1620-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x0007000000012116-11.dat	upx
behavioral1/memory/1984-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1620-15-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1984-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-17_334feceeb5e88725ca39b198b5aa53e8_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1984	1620	2024-10-17_334feceeb5e88725ca39b198b5aa53e8_cryptolocker.exe	30
PID 1620 wrote to memory of 1984	1620	2024-10-17_334feceeb5e88725ca39b198b5aa53e8_cryptolocker.exe	30
PID 1620 wrote to memory of 1984	1620	2024-10-17_334feceeb5e88725ca39b198b5aa53e8_cryptolocker.exe	30
PID 1620 wrote to memory of 1984	1620	2024-10-17_334feceeb5e88725ca39b198b5aa53e8_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-10-17_334feceeb5e88725ca39b198b5aa53e8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-17_334feceeb5e88725ca39b198b5aa53e8_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
55KB

MD5
30b3a5ae3ad65f0517a76c3473c7131d

SHA1
9bcde15e422caf9c8e25b53d756812e52ce29e8a

SHA256
562f8b712d073daeaa15979a090867da475c86895da5e60640d005a87da659ac

SHA512
7cf569c34205d4edcda66c9eb9517fd8223046ed25b4fef29470cb5509899e2da497810a66a83eebae91ab39c64383ee1cfa2f63b52286defabe15b68ad9a6bf

Download Submit
memory/1620-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1620-2-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/1620-9-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/1620-1-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/1620-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1984-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1984-18-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1984-19-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/1984-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download