f2eda6a687fce183d2f99ca621432999731a2aab475b9c538b413a3f1a2730a4

Analysis

max time kernel
132s
max time network
139s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 08:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-27_18c99e0bc12302df7d958682891ad22a_cryptolocker.exe
Size

55KB
MD5

18c99e0bc12302df7d958682891ad22a
SHA1

c8dbf398bcffb088981a2ded3838bade772a4049
SHA256

f2eda6a687fce183d2f99ca621432999731a2aab475b9c538b413a3f1a2730a4
SHA512

608c1cb46eecfd693b9f57db383164162e23c65461035c333227d2976b506d4a44c74407c114ea6075fddbda996e6ab42087fd11ad20ba9fc7c7f1d0539dcd4e
SSDEEP

768:79inqyNR/QtOOtEvwDpjBK/rJ+Nw8qn8pKIRszDr6KAtEZ:79mqyNhQMOtEvwDpjBxe8TpXRSDeKTZ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1836	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1712	2024-07-27_18c99e0bc12302df7d958682891ad22a_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-07-27_18c99e0bc12302df7d958682891ad22a_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1836	1712	2024-07-27_18c99e0bc12302df7d958682891ad22a_cryptolocker.exe	30
PID 1712 wrote to memory of 1836	1712	2024-07-27_18c99e0bc12302df7d958682891ad22a_cryptolocker.exe	30
PID 1712 wrote to memory of 1836	1712	2024-07-27_18c99e0bc12302df7d958682891ad22a_cryptolocker.exe	30
PID 1712 wrote to memory of 1836	1712	2024-07-27_18c99e0bc12302df7d958682891ad22a_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-07-27_18c99e0bc12302df7d958682891ad22a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-27_18c99e0bc12302df7d958682891ad22a_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
55KB

MD5
d01a79164af5fcb6f5967abdebf55991

SHA1
e518b6be584569175799d211d2e97d51d40b373f

SHA256
224e9ab376e6260c62f7479076e818aaec69b2b060fc2e96e1232b44621da5ce

SHA512
3e10cbd0a0d98704bffbe1eb514625826df9cfafab3568ab669c5f0ff04eb0d389b87465747e57e59761ae66d6ea0f8521c37ac5f5f627e529bedde439753aa2

Download Submit
memory/1712-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1712-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1712-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1712-2-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/1712-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1836-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1836-18-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download