fa3abfe685f0b1c7f88dd2cb0f319f05fa8be4699ba6af1cd1918badb6d3528e

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
02-11-2024 06:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-02_c5a01fd34ca5d14ee65bb7297d2aa205_cryptolocker.exe
Size

28KB
MD5

c5a01fd34ca5d14ee65bb7297d2aa205
SHA1

16d26181b4c640fb29d1ee39711dedee2ad7d140
SHA256

fa3abfe685f0b1c7f88dd2cb0f319f05fa8be4699ba6af1cd1918badb6d3528e
SHA512

9b214a558cdf26c7f905ece8668dfb2909636a4b094918b70a55e30cf587bd053c2b3b49d9ab5dcd5fb47e5df2ed21b805725a50221103179b6cebd10a8a443c
SSDEEP

768:IRFBgME4kmW6FtnKn7DI6tOOtEvwDpjYx:SgME4kJ6D0MOtEvwDpjYx

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2820 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-11-02_c5a01fd34ca5d14ee65bb7297d2aa205_cryptolocker.exe

pid process

2448 2024-11-02_c5a01fd34ca5d14ee65bb7297d2aa205_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2820	misid.exe

pid	process
2448	2024-11-02_c5a01fd34ca5d14ee65bb7297d2aa205_cryptolocker.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2024-11-02_c5a01fd34ca5d14ee65bb7297d2aa205_cryptolocker.exemisid.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-02_c5a01fd34ca5d14ee65bb7297d2aa205_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-11-02_c5a01fd34ca5d14ee65bb7297d2aa205_cryptolocker.exe

description	pid	process	target process
PID 2448 wrote to memory of 2820	2448	2024-11-02_c5a01fd34ca5d14ee65bb7297d2aa205_cryptolocker.exe	misid.exe
PID 2448 wrote to memory of 2820	2448	2024-11-02_c5a01fd34ca5d14ee65bb7297d2aa205_cryptolocker.exe	misid.exe
PID 2448 wrote to memory of 2820	2448	2024-11-02_c5a01fd34ca5d14ee65bb7297d2aa205_cryptolocker.exe	misid.exe
PID 2448 wrote to memory of 2820	2448	2024-11-02_c5a01fd34ca5d14ee65bb7297d2aa205_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-02_c5a01fd34ca5d14ee65bb7297d2aa205_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-02_c5a01fd34ca5d14ee65bb7297d2aa205_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
28KB

MD5
4d136f9524a9b08bbe13dc2e711dbfef

SHA1
ae55df4bb034f6deeebfd5f1a47d37912d8fe690

SHA256
b9d1831a6b75e1e5f549da3090e6e5a17db435b1c153a15875aabc251d3d3984

SHA512
280f6e43fe71b95df9d880bbfc71dbdb3717426212198c1b927af814df6e6575ac4ed0eceb7e3b6085ce668c61b25f6a5875c69dda64c695f18d8b4c6458bc0f

Download Submit
memory/2448-0-0x0000000000500000-0x0000000000514000-memory.dmp

Filesize
80KB

Download
memory/2448-2-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2448-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2448-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2448-16-0x0000000000500000-0x0000000000514000-memory.dmp

Filesize
80KB

Download
memory/2448-14-0x0000000000660000-0x0000000000674000-memory.dmp

Filesize
80KB

Download
memory/2820-17-0x0000000000500000-0x0000000000514000-memory.dmp

Filesize
80KB

Download
memory/2820-19-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2820-26-0x0000000000500000-0x0000000000514000-memory.dmp

Filesize
80KB

Download