a9863ece7a20d8d5de0ee8d1a6a6e81ae12eea0f73344246b8db7bae59917a9d

Analysis

max time kernel
132s
max time network
139s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 10:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-08-14_689de4cf94464619220dd3313a7e8e4b_cryptolocker.exe
Size

63KB
MD5

689de4cf94464619220dd3313a7e8e4b
SHA1

06e2db9544f328323f1ad65d09592998ed7f7e41
SHA256

a9863ece7a20d8d5de0ee8d1a6a6e81ae12eea0f73344246b8db7bae59917a9d
SHA512

774cf027838fd989b881452b917020c4820197f18d742cbdad5792a7251b0aeca1aeae2ebe61a9c51ad7ef9d2cf0fd825b203ec78319fb8f59fbdbaa11588b4b
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBccD2RuoNmuBLZ/xblzopL:X6a+SOtEvwDpjBrOs

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1452	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2540	2024-08-14_689de4cf94464619220dd3313a7e8e4b_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-14_689de4cf94464619220dd3313a7e8e4b_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 1452	2540	2024-08-14_689de4cf94464619220dd3313a7e8e4b_cryptolocker.exe	31
PID 2540 wrote to memory of 1452	2540	2024-08-14_689de4cf94464619220dd3313a7e8e4b_cryptolocker.exe	31
PID 2540 wrote to memory of 1452	2540	2024-08-14_689de4cf94464619220dd3313a7e8e4b_cryptolocker.exe	31
PID 2540 wrote to memory of 1452	2540	2024-08-14_689de4cf94464619220dd3313a7e8e4b_cryptolocker.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-08-14_689de4cf94464619220dd3313a7e8e4b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-14_689de4cf94464619220dd3313a7e8e4b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
63KB

MD5
793d41bfe47811deea9094a4a68a63ad

SHA1
9cf54c1c1046d78e44417ff75963389a279f2921

SHA256
16ae350a9221bf9298e002b4decbf3a2404bd885a5dbd608a87f6d436a1a4e66

SHA512
2c03f9158bc2a4f3f990b772bdc0e4ee9fa34433c8b1c8628055a2fd067d09ed3773e553d279ade7be631305f22a323a2b397c07c5176c59865e326273ad055f

Download Submit
memory/1452-22-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/1452-15-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2540-1-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2540-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2540-8-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download