05654b58b60ca4b7f7dcad15251e0599ae914c61bf168a85355ed95d5adbf76b

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 07:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-21_e39def1c84a7d2af2fa52e427015e3c7_cryptolocker.exe
Size

52KB
MD5

e39def1c84a7d2af2fa52e427015e3c7
SHA1

64806f8f877184192ad6201f50309a52c27640d4
SHA256

05654b58b60ca4b7f7dcad15251e0599ae914c61bf168a85355ed95d5adbf76b
SHA512

c3a8d34d425220c29765751bf600e6f57fe20556dedd2e7324832e9cc5197e00db9d51ee2967e1ace49002e727518b0bafd89c5246a377981903e6d11636c8c3
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrr42A7n0FmB0ntS:vj+jsMQMOtEvwDpj5HczerLO04BP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2888 misid.exe
Loads dropped DLL 1 IoCs

Processes:

2024-11-21_e39def1c84a7d2af2fa52e427015e3c7_cryptolocker.exe

pid process

2796 2024-11-21_e39def1c84a7d2af2fa52e427015e3c7_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2888	misid.exe

pid	process
2796	2024-11-21_e39def1c84a7d2af2fa52e427015e3c7_cryptolocker.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2024-11-21_e39def1c84a7d2af2fa52e427015e3c7_cryptolocker.exemisid.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-21_e39def1c84a7d2af2fa52e427015e3c7_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misid.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-11-21_e39def1c84a7d2af2fa52e427015e3c7_cryptolocker.exe

description	pid	process	target process
PID 2796 wrote to memory of 2888	2796	2024-11-21_e39def1c84a7d2af2fa52e427015e3c7_cryptolocker.exe	misid.exe
PID 2796 wrote to memory of 2888	2796	2024-11-21_e39def1c84a7d2af2fa52e427015e3c7_cryptolocker.exe	misid.exe
PID 2796 wrote to memory of 2888	2796	2024-11-21_e39def1c84a7d2af2fa52e427015e3c7_cryptolocker.exe	misid.exe
PID 2796 wrote to memory of 2888	2796	2024-11-21_e39def1c84a7d2af2fa52e427015e3c7_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-21_e39def1c84a7d2af2fa52e427015e3c7_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-21_e39def1c84a7d2af2fa52e427015e3c7_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
52KB

MD5
7e23c8a043f87b20a4078e5a4b733e87

SHA1
8d241e2694591b6e5966f2221a44ea6eaa31e4e4

SHA256
e92bc5f11b46f240e69e40001f0120c799a4aa0e968ec018169038efed97e637

SHA512
a50aef4d041b06b8fc216c42ee68e3e7827dd40fbeee54e004955d6d1fa3772782ecc2c90622f643ddaba2be6e4a3a5117bfd67afb87b8d14dfa4125b8b06de6

Download Submit
memory/2796-1-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/2796-0-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2796-8-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2888-22-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2888-15-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download