9b462800f1bef019d7ec00098682d3ea7fc60e6721555f616399228e4e3ad122

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 19:27

Target

TeslaCrypt-1.exe
Size

257KB
MD5

6e080aa085293bb9fbdcc9015337d309
SHA1

51b4ef5dc9d26b7a26e214cee90598631e2eaa67
SHA256

9b462800f1bef019d7ec00098682d3ea7fc60e6721555f616399228e4e3ad122
SHA512

4e173fb5287c7ea8ff116099ec1a0599b37f743f8b798368319b5960af38e742124223dfd209457665b701e9efc6e76071fa2513322b232ac50ddad21fcebe77
SSDEEP

6144:xy+als+0nIycigV5cbEo6dZbBODPIsjQ/UFsYW:xy+aCFnIycigVSbObBODTMUd

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

TeslaCrypt-1.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TeslaCrypt-1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TeslaCrypt-1.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

TeslaCrypt-1.exe

description	pid	process	target process
PID 412 wrote to memory of 4324	412	TeslaCrypt-1.exe	TeslaCrypt-1.exe
PID 412 wrote to memory of 4324	412	TeslaCrypt-1.exe	TeslaCrypt-1.exe
PID 412 wrote to memory of 4324	412	TeslaCrypt-1.exe	TeslaCrypt-1.exe

C:\Users\Admin\AppData\Local\Temp\TeslaCrypt-1.exe
"C:\Users\Admin\AppData\Local\Temp\TeslaCrypt-1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:412
- C:\Users\Admin\AppData\Local\Temp\TeslaCrypt-1.exe
  C:\Users\Admin\AppData\Local\Temp\TeslaCrypt-1.exe
  2⤵
  PID:4324

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/412-0-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download