Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
20/11/2024, 03:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-11-20_5c152914c12de19beb74d5082527056c_cryptolocker.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
2024-11-20_5c152914c12de19beb74d5082527056c_cryptolocker.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-11-20_5c152914c12de19beb74d5082527056c_cryptolocker.exe
-
Size
38KB
-
MD5
5c152914c12de19beb74d5082527056c
-
SHA1
8e9d5bd914e8777458d9cd58b468269e02f07177
-
SHA256
17ff2c07cc3744a7718eaacdca5e6e41b5fecdb5a80a6dab831fdc9b56b1a6dd
-
SHA512
df077d748ba6109eac48f9cc721dc2faff6f009dab7758ae45ad278099dc168e0e1c335aa388bcaf7b055bf07f86a3c99ac2b96a297f47a746bb1479599c845e
-
SSDEEP
768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4A:fT+hsMQMOtEvwDpjoIHA
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2788 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 2452 2024-11-20_5c152914c12de19beb74d5082527056c_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-11-20_5c152914c12de19beb74d5082527056c_cryptolocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language misid.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2452 wrote to memory of 2788 2452 2024-11-20_5c152914c12de19beb74d5082527056c_cryptolocker.exe 30 PID 2452 wrote to memory of 2788 2452 2024-11-20_5c152914c12de19beb74d5082527056c_cryptolocker.exe 30 PID 2452 wrote to memory of 2788 2452 2024-11-20_5c152914c12de19beb74d5082527056c_cryptolocker.exe 30 PID 2452 wrote to memory of 2788 2452 2024-11-20_5c152914c12de19beb74d5082527056c_cryptolocker.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-20_5c152914c12de19beb74d5082527056c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-20_5c152914c12de19beb74d5082527056c_cryptolocker.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD5744df4a769d6b0f253ae05c39cbc43af
SHA19d180a0e0eadc1c4987376810686f15ad8f7380d
SHA256f0d5d5243cd11b17e8791b1c9444ab27bec0bf9c809b6ee9b2b8d632ef03f001
SHA512e51f7596125de2f6edccf68c24e68edeeff76641cf4c78fd851ac698e4c9f7ed0a3a5adc39daed82f18ecd55b37752396f5ece0d3575cf4e0b174ae5f68e8add