02947e8e5f551db51108ef9a2f2935b7463f791719e39e14534099fa62c8b9f9

Analysis

max time kernel
150s
max time network
157s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 03:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-20_2cfeac8ecde3a0990f3ede0159b8229b_cryptolocker.exe
Size

74KB
MD5

2cfeac8ecde3a0990f3ede0159b8229b
SHA1

5205bb1c8fc1105cbb84060680a90306a8b92675
SHA256

02947e8e5f551db51108ef9a2f2935b7463f791719e39e14534099fa62c8b9f9
SHA512

b856bb9a85ec1752c4d96a39629256afae059d0ea19d1fe66dc611955f86aa3ae8946216297812972af1ca6ae68f525dba005f613b4e21281ab91fb9d3d63a73
SSDEEP

768:9UQz7yVEhs9+4T/1bytOOtEvwDpjLXOQ69zbjlAAX5e9zi:9Uj+AIMOtEvwDpjLizbR9Xwzi

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2648	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2668	2024-11-20_2cfeac8ecde3a0990f3ede0159b8229b_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-20_2cfeac8ecde3a0990f3ede0159b8229b_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2648	2668	2024-11-20_2cfeac8ecde3a0990f3ede0159b8229b_cryptolocker.exe	30
PID 2668 wrote to memory of 2648	2668	2024-11-20_2cfeac8ecde3a0990f3ede0159b8229b_cryptolocker.exe	30
PID 2668 wrote to memory of 2648	2668	2024-11-20_2cfeac8ecde3a0990f3ede0159b8229b_cryptolocker.exe	30
PID 2668 wrote to memory of 2648	2668	2024-11-20_2cfeac8ecde3a0990f3ede0159b8229b_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-11-20_2cfeac8ecde3a0990f3ede0159b8229b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-20_2cfeac8ecde3a0990f3ede0159b8229b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
75KB

MD5
609834c4348f65f8d51366110e0b347d

SHA1
5d4006720d8f4eb643a4f2195104a456cecc367d

SHA256
9a16270be35e932a8057140fdec63ca0e96bc141efd3a6277c65c2810c903b57

SHA512
234369e7b2587bd5c5b075d88ac7767d31ee2355d141ddcaedb65fddb7f2386bbf17d51532a45f2b5b73e1dc865a45e2bc8c78b06422f9d250487e3ea5a6a83d

Download Submit
memory/2648-15-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2648-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2668-1-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2668-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2668-8-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download