a34a7a47071c6148f4b4c86696df05760ca10f7c6423798d4d60c69a7c578e49

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 05:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-20_fa10106133d53bd2e43f0afc44ecd329_cryptolocker.exe
Size

72KB
MD5

fa10106133d53bd2e43f0afc44ecd329
SHA1

122c6d5dcf2913ce264c9f70fce8f41455d0d90e
SHA256

a34a7a47071c6148f4b4c86696df05760ca10f7c6423798d4d60c69a7c578e49
SHA512

1586e485fe6369acf02e3c6cc7f66f01f386777b29fefecaed4d4d0178c53989c79ab6ad20895a61ae50d8d86f067d986eda89f42b8f1791390c9e811f152084
SSDEEP

1536:nj+4zs2cPVhlMOtEvwDpj4H8u8rZVTs9N:C4Q2c94OtEvwDpj4H8z8

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2912	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2196	2024-11-20_fa10106133d53bd2e43f0afc44ecd329_cryptolocker.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2196-8-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x000c00000001226d-15.dat	upx
behavioral1/memory/2912-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2912-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-20_fa10106133d53bd2e43f0afc44ecd329_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2912	2196	2024-11-20_fa10106133d53bd2e43f0afc44ecd329_cryptolocker.exe	31
PID 2196 wrote to memory of 2912	2196	2024-11-20_fa10106133d53bd2e43f0afc44ecd329_cryptolocker.exe	31
PID 2196 wrote to memory of 2912	2196	2024-11-20_fa10106133d53bd2e43f0afc44ecd329_cryptolocker.exe	31
PID 2196 wrote to memory of 2912	2196	2024-11-20_fa10106133d53bd2e43f0afc44ecd329_cryptolocker.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-11-20_fa10106133d53bd2e43f0afc44ecd329_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-20_fa10106133d53bd2e43f0afc44ecd329_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
72KB

MD5
2f0ea0f2874d80a2c0dee08a0801ef4c

SHA1
f98bcdf60d222408fbbef7802fd9161d55638bbf

SHA256
05c9af57cd46812ad6c085dedd672672d7878278d25c6bdda814348c9f5af5a3

SHA512
04d6eae441199140721b68931700cce1873e33d009f094abe5403465dfea42ea7d62850e704464af6c88b5c680c482ee7d6be7d2f71144fa42a91587e66e0fcc

Download Submit
memory/2196-1-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2196-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2196-8-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2196-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2912-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2912-25-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2912-18-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2912-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download