52bcad3a1004b2da936a7fdd0510dbac9d690e966c59a970c289947a842cc64d

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-10-17_dda49ef52298b218491e73b679518fb5_cryptolocker.exe
Size

75KB
MD5

dda49ef52298b218491e73b679518fb5
SHA1

90b57b99baedc66039ca813d1dab1fde4b444f2f
SHA256

52bcad3a1004b2da936a7fdd0510dbac9d690e966c59a970c289947a842cc64d
SHA512

4389e01d9c486b98ec34bb8b5a92a32a5a1d8f47ae55b5ad8d7e3e83cab9f0554e3c1b1fdb271b2f1b38b48d4c2bd1018301fb2b54ac6d8464000ad35c33f25f
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfIufB:vCjsIOtEvwDpj5H9YvQd2l

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2980	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2300	2024-10-17_dda49ef52298b218491e73b679518fb5_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-17_dda49ef52298b218491e73b679518fb5_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2980	2300	2024-10-17_dda49ef52298b218491e73b679518fb5_cryptolocker.exe	30
PID 2300 wrote to memory of 2980	2300	2024-10-17_dda49ef52298b218491e73b679518fb5_cryptolocker.exe	30
PID 2300 wrote to memory of 2980	2300	2024-10-17_dda49ef52298b218491e73b679518fb5_cryptolocker.exe	30
PID 2300 wrote to memory of 2980	2300	2024-10-17_dda49ef52298b218491e73b679518fb5_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-10-17_dda49ef52298b218491e73b679518fb5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-17_dda49ef52298b218491e73b679518fb5_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
75KB

MD5
b08ce797dc96a1e1b8040775c4173f32

SHA1
a99183bc3dcdeab9d52de439a9dceee98b18bf68

SHA256
e4cd261ea07e79f47da66bc45ff9bebdaf12049ed7741d2d73942a62084b3e3b

SHA512
df54571d3aa1a6182bca4e78fc6a3b818a6309378c71a760d836b94b04b5e81375ddf2e217c5964699ae37b99875f4f239d648d6ec801b6a6530e9cd68de15ee

Download Submit
memory/2300-1-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2300-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2300-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2980-15-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download