e5acfca561cd409e4de35d9ac1154fce16569c14385ca116dccf4e7dfe1e3bfd

Analysis

max time kernel
146s
max time network
152s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-20_61f7d39c9bbd2ca976c9b32fa42ac8fa_cryptolocker.exe
Size

25KB
MD5

61f7d39c9bbd2ca976c9b32fa42ac8fa
SHA1

ad5544facbe4350aaa055ba4459033aa1fc1c165
SHA256

e5acfca561cd409e4de35d9ac1154fce16569c14385ca116dccf4e7dfe1e3bfd
SHA512

16d2c6c3d45d48220335a3d3cce8cdad8ccd55b39627500ffe5d4b46546f2a6b6d7bdfef8b44933f3511a41cb11f9fa62cb708394d616c38a3578bcbf23efb52
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/P4QtOOtEvwDpjq:ZzFbxmLP4QMOtEvwDpjq

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2052	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1276	2024-11-20_61f7d39c9bbd2ca976c9b32fa42ac8fa_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-20_61f7d39c9bbd2ca976c9b32fa42ac8fa_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 2052	1276	2024-11-20_61f7d39c9bbd2ca976c9b32fa42ac8fa_cryptolocker.exe	29
PID 1276 wrote to memory of 2052	1276	2024-11-20_61f7d39c9bbd2ca976c9b32fa42ac8fa_cryptolocker.exe	29
PID 1276 wrote to memory of 2052	1276	2024-11-20_61f7d39c9bbd2ca976c9b32fa42ac8fa_cryptolocker.exe	29
PID 1276 wrote to memory of 2052	1276	2024-11-20_61f7d39c9bbd2ca976c9b32fa42ac8fa_cryptolocker.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-11-20_61f7d39c9bbd2ca976c9b32fa42ac8fa_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-20_61f7d39c9bbd2ca976c9b32fa42ac8fa_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
25KB

MD5
5c730be97e126e25668328ada44e4b83

SHA1
b3b70afc23b358125c134c84fddb779ff6a96db0

SHA256
c5b9c4c59b956040f2d3a0ac12714d68f1da94715ed0834d37aaa3e3843a2741

SHA512
6c2523d916bd421912333466b3ee7629ba14a7ac046d8187712b8f856a497a90c61de25afba7c6d37a5b9bd86aee813a25be957c70d9570e5e0991461b66707b

Download Submit
memory/1276-0-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/1276-1-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1276-2-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/1276-9-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1276-15-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2052-17-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2052-24-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download