4018e75be60acefac3e57e32c978f14f3637fdb1f1da6edf798ce423ca2d70a0

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-21_f634b76e3b7e399bb0d149d945a41e88_cryptolocker.exe
Size

73KB
MD5

f634b76e3b7e399bb0d149d945a41e88
SHA1

50678c49232ee774f54865baf7b75f3de33de19e
SHA256

4018e75be60acefac3e57e32c978f14f3637fdb1f1da6edf798ce423ca2d70a0
SHA512

07c7284c1bf3eb610c4411e6635fe6827cdedde25abb0fb3005bbe2bff70418fffaf7137ad172e398987ff03336f8fdb5cfc91c15059f4ee71074d2796e542db
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4ZPsED3VK2+ZtyOjgO4r9vFAg2rq2g1B/Rx:vj+jsMQMOtEvwDpj5HZYTjipvF24p

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

1880 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-11-21_f634b76e3b7e399bb0d149d945a41e88_cryptolocker.exe

pid process

2204 2024-11-21_f634b76e3b7e399bb0d149d945a41e88_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1880	misid.exe

pid	process
2204	2024-11-21_f634b76e3b7e399bb0d149d945a41e88_cryptolocker.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2024-11-21_f634b76e3b7e399bb0d149d945a41e88_cryptolocker.exemisid.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-21_f634b76e3b7e399bb0d149d945a41e88_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-11-21_f634b76e3b7e399bb0d149d945a41e88_cryptolocker.exe

description	pid	process	target process
PID 2204 wrote to memory of 1880	2204	2024-11-21_f634b76e3b7e399bb0d149d945a41e88_cryptolocker.exe	misid.exe
PID 2204 wrote to memory of 1880	2204	2024-11-21_f634b76e3b7e399bb0d149d945a41e88_cryptolocker.exe	misid.exe
PID 2204 wrote to memory of 1880	2204	2024-11-21_f634b76e3b7e399bb0d149d945a41e88_cryptolocker.exe	misid.exe
PID 2204 wrote to memory of 1880	2204	2024-11-21_f634b76e3b7e399bb0d149d945a41e88_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-21_f634b76e3b7e399bb0d149d945a41e88_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-21_f634b76e3b7e399bb0d149d945a41e88_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
73KB

MD5
03458a81a5386857109b2128b543608a

SHA1
ffe3d7ad26550d6ed9f695adbd56573649f46ddf

SHA256
262505533ccb3016af6c736c1799f1f50f72289e422e6173ff1efba752d2ba50

SHA512
6622d5c0a240b07d958d10f9510ec08126e21b6bf492afee0cd5e8a2f04db1c18978c1fe924d4bd2dd5b4da4d15ffbee8688b0a58b5aa1c9c1eab260d9283a0f

Download Submit
memory/1880-22-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1880-15-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2204-0-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2204-1-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download
memory/2204-8-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download