a10bf157cb718f542ef8a6d270b7568fa9c3b8181c5dd1d678bea91419b5ae53

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-18_7288266afc499f898688a6260b78969e_cryptolocker.exe
Size

70KB
MD5

7288266afc499f898688a6260b78969e
SHA1

d822effd254f9367f5c6fa9a6e341943e27b319e
SHA256

a10bf157cb718f542ef8a6d270b7568fa9c3b8181c5dd1d678bea91419b5ae53
SHA512

4dd602b67fc09a3c3f153070efd81b3b308df9d39ee0e200d8e506ba8e0e5a6b4d32459570902fa057da4534bad6e2e76509e4574620288c503cec1aa034efd9
SSDEEP

768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRXrZSUNsYD/dQ:i5nkFGMOtEvwDpjNbwQEI8UZDG

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1136	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2712	2024-10-18_7288266afc499f898688a6260b78969e_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-18_7288266afc499f898688a6260b78969e_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 1136	2712	2024-10-18_7288266afc499f898688a6260b78969e_cryptolocker.exe	30
PID 2712 wrote to memory of 1136	2712	2024-10-18_7288266afc499f898688a6260b78969e_cryptolocker.exe	30
PID 2712 wrote to memory of 1136	2712	2024-10-18_7288266afc499f898688a6260b78969e_cryptolocker.exe	30
PID 2712 wrote to memory of 1136	2712	2024-10-18_7288266afc499f898688a6260b78969e_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-10-18_7288266afc499f898688a6260b78969e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-18_7288266afc499f898688a6260b78969e_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
71KB

MD5
d30773bc2cc8ea04b57a6ed877a239e8

SHA1
df655b9e6875eccfb444fb63c7c311fbd98ae903

SHA256
c8f0646937adadef88197cc890998c309bd1ec839ed6cc3e067137e051019a94

SHA512
8f1b57e7b5ba6c0e3bc7661ec959abb8b34ada5c017473422bb909369d80264e64877723d62f853abdabb440975357fe63890ea44e3601147fbab99716a87915

Download Submit
memory/1136-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1136-19-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/1136-26-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1136-27-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2712-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2712-9-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2712-2-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2712-1-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2712-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download