b41f5883d8aa1ac37362865f3a36e5e60647e0f0c9ed5a1a90f7cb558f17e63d

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-09-2024 12:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-05_8e0941ce64fc5f491ef0aa7c60076cf9_cryptolocker.exe
Size

55KB
MD5

8e0941ce64fc5f491ef0aa7c60076cf9
SHA1

174a4a2a0279754b44ac7853b28b3270c23650ec
SHA256

b41f5883d8aa1ac37362865f3a36e5e60647e0f0c9ed5a1a90f7cb558f17e63d
SHA512

d1fcdfa423c11642c748cc7f52d490c58178e9fc2a490af8e1c54651dbab3c87ca564f03203479b07e50be1115452d3b6e8397f2c960cfb1bb40f4c7cdfb12e4
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vxmlcaTIo:X6QFElP6n+gJBMOtEvwDpjBtExmlr

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2772	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2844	2024-09-05_8e0941ce64fc5f491ef0aa7c60076cf9_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-05_8e0941ce64fc5f491ef0aa7c60076cf9_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2772	2844	2024-09-05_8e0941ce64fc5f491ef0aa7c60076cf9_cryptolocker.exe	31
PID 2844 wrote to memory of 2772	2844	2024-09-05_8e0941ce64fc5f491ef0aa7c60076cf9_cryptolocker.exe	31
PID 2844 wrote to memory of 2772	2844	2024-09-05_8e0941ce64fc5f491ef0aa7c60076cf9_cryptolocker.exe	31
PID 2844 wrote to memory of 2772	2844	2024-09-05_8e0941ce64fc5f491ef0aa7c60076cf9_cryptolocker.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-09-05_8e0941ce64fc5f491ef0aa7c60076cf9_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-05_8e0941ce64fc5f491ef0aa7c60076cf9_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
55KB

MD5
319527475ff543a02bb8b57199ec92f7

SHA1
5374bad7254295bde09b4035f823659ae6baf31f

SHA256
52bb0192503b4b716a906c72d74c677ae60c4a5a763e0b516d56cad4ef309e09

SHA512
95f6f37a9798bd7096811896e2c3e1f3281d4e4115110494d42fb575b84acef9df9d5627fc5eea7cecde89e29af8127584bf2bad6dc9ad793c195c7cf34b9d85

Download Submit
memory/2772-16-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/2772-15-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2844-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2844-1-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2844-7-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download