Analysis

  • max time kernel
    145s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    31-10-2024 08:25

General

  • Target

    2024-10-31_5612db90317cfbbcd54b2f2b8a39a689_cryptolocker.exe

  • Size

    53KB

  • MD5

    5612db90317cfbbcd54b2f2b8a39a689

  • SHA1

    47d23e1a8f1999d4a06afd39f086d9e54d2635ba

  • SHA256

    c35de460f8df8b72f036f1d2e841acaedbd8c26cf135bc989385ea62e3a1cc78

  • SHA512

    eb7a1d6585de3767473888b35761ac9cc07b661c4ce64d42eafd8049592d7d117e0a30b9b14bc2b1fda56f55e9b4eb745605005cf06969c6f883284057021d31

  • SSDEEP

    768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZgBh8i6g7Gop:xj+VGMOtEvwDpjubEg8

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-31_5612db90317cfbbcd54b2f2b8a39a689_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-31_5612db90317cfbbcd54b2f2b8a39a689_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2484
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2776

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    53KB

    MD5

    5a26e71dcd01bfa6bf6e3b627c00bb13

    SHA1

    2055716fd3fde229ee2e64152a34175bf04e5b4c

    SHA256

    e671cc8a123b1247aa002c263623762b30906d37f5500e6fa103123b5a8258f3

    SHA512

    6db0fadaa0750b7208574a15e615a1559565ba699501901181ac42fb6c497064a3950f4aa4cf2668bb3f124373f6b9d768223e2c88aa8371f358d98c8237927d

  • memory/2484-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2484-1-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2484-9-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2484-2-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB

  • memory/2484-13-0x0000000001EB0000-0x0000000001EC0000-memory.dmp

    Filesize

    64KB

  • memory/2484-17-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2776-16-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2776-19-0x0000000000270000-0x0000000000276000-memory.dmp

    Filesize

    24KB

  • memory/2776-26-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB