a5fdb8857ba2d3b6d88873ac688ae979c092a12a957462ce7289c34e1d80cf3a

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 03:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-20_825cdbda28877c3fa81c4b806f41c1c7_cryptolocker.exe
Size

53KB
MD5

825cdbda28877c3fa81c4b806f41c1c7
SHA1

cc66380b22293eae5daba73cfd13d07eecc4640e
SHA256

a5fdb8857ba2d3b6d88873ac688ae979c092a12a957462ce7289c34e1d80cf3a
SHA512

52be0527f9db975b224db0c98858fd58b0432c6e0eb2eb1a1d0091d6223c001db2926533f3cc7d3edabb40745706dc2a8ecd31726469ecf5f47309292ed63141
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4hdCW1nw71TkhsiPn1YFvPt:vj+jsMQMOtEvwDpj5HH1nw73KOFt

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
348	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2992	2024-11-20_825cdbda28877c3fa81c4b806f41c1c7_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-20_825cdbda28877c3fa81c4b806f41c1c7_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 348	2992	2024-11-20_825cdbda28877c3fa81c4b806f41c1c7_cryptolocker.exe	30
PID 2992 wrote to memory of 348	2992	2024-11-20_825cdbda28877c3fa81c4b806f41c1c7_cryptolocker.exe	30
PID 2992 wrote to memory of 348	2992	2024-11-20_825cdbda28877c3fa81c4b806f41c1c7_cryptolocker.exe	30
PID 2992 wrote to memory of 348	2992	2024-11-20_825cdbda28877c3fa81c4b806f41c1c7_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-11-20_825cdbda28877c3fa81c4b806f41c1c7_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-20_825cdbda28877c3fa81c4b806f41c1c7_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
53KB

MD5
65e49a58c9ef752c885aa13f6d42c47c

SHA1
e88639fa760888e38937741460b599c5304f52e0

SHA256
59b2b238d7d8b841e080aaac50b0bad471bc708af0843e408eb7ef09b41eed9d

SHA512
613fc66248b235efc8b70f11c57d2b8a059535a4f9e47b4451fa22c1f84497740826fec0ef624fb1a9fa016dc6e78a2bb32f576dd8ec0e20d5a4759c25bdde33

Download Submit
memory/348-15-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2992-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2992-1-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2992-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download