a38930b62b3927d3f66dba6769727b5786bab2b44ffaa2012265e96f37113610

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-11-2024 06:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-02_054409def3e4d25752d74e4ebb23a94d_cryptolocker.exe
Size

51KB
MD5

054409def3e4d25752d74e4ebb23a94d
SHA1

2d4204f1f281101332cf1bf1204272f7bfe68d50
SHA256

a38930b62b3927d3f66dba6769727b5786bab2b44ffaa2012265e96f37113610
SHA512

0f8dd6c3189a8a485f58d67211218556f110ba37112f840a9e31ee1fda4e639caf8726182526f20bba526d91e0695907cbd1a3297a532f7189d758c24b43b341
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrr42A7n0FmB0noj:vj+jsMQMOtEvwDpj5HczerLO04B/

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

1604 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-11-02_054409def3e4d25752d74e4ebb23a94d_cryptolocker.exe

pid process

2924 2024-11-02_054409def3e4d25752d74e4ebb23a94d_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1604	misid.exe

pid	process
2924	2024-11-02_054409def3e4d25752d74e4ebb23a94d_cryptolocker.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

misid.exe2024-11-02_054409def3e4d25752d74e4ebb23a94d_cryptolocker.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-02_054409def3e4d25752d74e4ebb23a94d_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-11-02_054409def3e4d25752d74e4ebb23a94d_cryptolocker.exe

description	pid	process	target process
PID 2924 wrote to memory of 1604	2924	2024-11-02_054409def3e4d25752d74e4ebb23a94d_cryptolocker.exe	misid.exe
PID 2924 wrote to memory of 1604	2924	2024-11-02_054409def3e4d25752d74e4ebb23a94d_cryptolocker.exe	misid.exe
PID 2924 wrote to memory of 1604	2924	2024-11-02_054409def3e4d25752d74e4ebb23a94d_cryptolocker.exe	misid.exe
PID 2924 wrote to memory of 1604	2924	2024-11-02_054409def3e4d25752d74e4ebb23a94d_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-02_054409def3e4d25752d74e4ebb23a94d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-02_054409def3e4d25752d74e4ebb23a94d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
51KB

MD5
96d74041390514ad96d479114f68905c

SHA1
e750935d0bbcd3e1a2e7a5e313e3e1c066964d05

SHA256
d88c82b011a9e910e4e3829cf3a71afbf1e66fb3533db4b15f55094023beab90

SHA512
b1a006a5bc20ca120e32da05f8ea090c20b25cf5f4e62afbc3877d922161f28bf81d1e08797dee5aede822719f7e149f9958a1082eb57ff6a40149bf6db817c2

Download Submit
memory/1604-15-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2924-8-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2924-1-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2924-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download