Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
10/11/2024, 06:48
Behavioral task
behavioral1
Sample
2024-11-10_de04995b99a2d948120a85e4d4be1b44_cryptolocker.exe
Resource
win7-20241010-en
General
-
Target
2024-11-10_de04995b99a2d948120a85e4d4be1b44_cryptolocker.exe
-
Size
83KB
-
MD5
de04995b99a2d948120a85e4d4be1b44
-
SHA1
ca38dfd1c8ec03bfe56cbf6419997c3632f9fab4
-
SHA256
e305bdef84eabe914fd1e6f7b413d55b0e46e9ded4adfb2f60182d9ded30f270
-
SHA512
4a3ceb0da5ae19649131a2bdcdcc3704eba4b61952e5d1eabb404e7c69a68d3725a42e35c3710d8ada1142d489151a107f3b2f74e81c1b00ed60e857cc491bb4
-
SSDEEP
1536:zj+soPSMOtEvwDpj4ktBl01hJ0tq1ky7Qix:zCsanOtEvwDpjW
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1512 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 2292 2024-11-10_de04995b99a2d948120a85e4d4be1b44_cryptolocker.exe -
resource yara_rule behavioral1/memory/2292-0-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/files/0x000d000000012257-11.dat upx behavioral1/memory/2292-14-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/1512-16-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/1512-26-0x0000000000500000-0x0000000000510000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-11-10_de04995b99a2d948120a85e4d4be1b44_cryptolocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language misid.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2292 wrote to memory of 1512 2292 2024-11-10_de04995b99a2d948120a85e4d4be1b44_cryptolocker.exe 31 PID 2292 wrote to memory of 1512 2292 2024-11-10_de04995b99a2d948120a85e4d4be1b44_cryptolocker.exe 31 PID 2292 wrote to memory of 1512 2292 2024-11-10_de04995b99a2d948120a85e4d4be1b44_cryptolocker.exe 31 PID 2292 wrote to memory of 1512 2292 2024-11-10_de04995b99a2d948120a85e4d4be1b44_cryptolocker.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-10_de04995b99a2d948120a85e4d4be1b44_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-10_de04995b99a2d948120a85e4d4be1b44_cryptolocker.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1512
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD5d43274dd4bcdd6aa18d096610702b94b
SHA1f8464d32afbcf3a8c91b42d26af807889164807d
SHA256d383b7f930989cd8641ef78865c141fe8b86dd0b1c119f40f03d6b85434f1ece
SHA5125f8bc874b078407f63fae7349b60b051c92775aa9013196e7f9ff6338ae34cd831e3d517279eebaa3d10d10b266900aeb7a54049f9b1e2685a1ced0fd4df99c5