be50f554006066a6e43779189f8c5fcfe3079acfb05ac9c412ccea606115d0f1

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 08:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-29_10dedc6897ee0f72e4fb2008a7ce31d8_cryptolocker.exe
Size

48KB
MD5

10dedc6897ee0f72e4fb2008a7ce31d8
SHA1

c5b1b06422d027fd8a6ef2a424024cbe17f67d62
SHA256

be50f554006066a6e43779189f8c5fcfe3079acfb05ac9c412ccea606115d0f1
SHA512

0d962ecb5495459cdbf65d3561c28efe08cc81ecb622bf65f50d4dc222c09fc6c2f6480243035f48b4dce9c03c31e01451e00bce65ae42ae5fe8553684c03749
SSDEEP

768:P6LsoEEeegiZPvEhHS5+Mh/QtOOtEvwDpjBpaD3TUogs/VXpAPlAd:P6QFElP6k+MRQMOtEvwDpjBQpVX8Ad

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2840	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2160	2024-08-29_10dedc6897ee0f72e4fb2008a7ce31d8_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-29_10dedc6897ee0f72e4fb2008a7ce31d8_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2840	2160	2024-08-29_10dedc6897ee0f72e4fb2008a7ce31d8_cryptolocker.exe	30
PID 2160 wrote to memory of 2840	2160	2024-08-29_10dedc6897ee0f72e4fb2008a7ce31d8_cryptolocker.exe	30
PID 2160 wrote to memory of 2840	2160	2024-08-29_10dedc6897ee0f72e4fb2008a7ce31d8_cryptolocker.exe	30
PID 2160 wrote to memory of 2840	2160	2024-08-29_10dedc6897ee0f72e4fb2008a7ce31d8_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-08-29_10dedc6897ee0f72e4fb2008a7ce31d8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-29_10dedc6897ee0f72e4fb2008a7ce31d8_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
48KB

MD5
ed1a83ed91faef9105f98e5a4b114482

SHA1
1f070b2ddd5524ea57ecccd94f9e6ece3130e4b0

SHA256
df17a1b7cf8db3943320a70517a9a880b5c99c16ed3ade8fa437876a224cf2bc

SHA512
c4d17888c2a73c8bed33fa338706a3b0de34518ee3c9999dfc061972661973f5abc90f0e226ce2e101d3ae4e694ab735756f60042f899383c9cace41c4ee4719

Download Submit
memory/2160-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2160-1-0x0000000000260000-0x0000000000266000-memory.dmp

Filesize
24KB

Download
memory/2160-2-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2160-10-0x0000000000260000-0x0000000000266000-memory.dmp

Filesize
24KB

Download
memory/2160-14-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2840-18-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2840-17-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2840-25-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download