f0b15ab5cd022e31ec4c7f7fa4162400b3c5c66bd975c0480fdc0b0bc8387783

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-08_dab04cd27f8a414c4a84505f7104368d_cryptolocker.exe
Size

75KB
MD5

dab04cd27f8a414c4a84505f7104368d
SHA1

61474540358956d2c2a63e049f6c630973fd071e
SHA256

f0b15ab5cd022e31ec4c7f7fa4162400b3c5c66bd975c0480fdc0b0bc8387783
SHA512

90973f0b81560a992d78e9cb5bf0151b01d0383f2d013b66ce755abbaeb2005962b713f0963d7d8f0aacf9c6ebc8b2be3e5dd434dd27c0987aca9f1eb04b4039
SSDEEP

768:u6LsoEEeegiZPvEhHSG+gZgtOOtEvwDpjeY10Y/YMsMG:u6QFElP6n+gWMOtEvwDpjJGYQbB

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
604	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2256	2024-09-08_dab04cd27f8a414c4a84505f7104368d_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-08_dab04cd27f8a414c4a84505f7104368d_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 604	2256	2024-09-08_dab04cd27f8a414c4a84505f7104368d_cryptolocker.exe	31
PID 2256 wrote to memory of 604	2256	2024-09-08_dab04cd27f8a414c4a84505f7104368d_cryptolocker.exe	31
PID 2256 wrote to memory of 604	2256	2024-09-08_dab04cd27f8a414c4a84505f7104368d_cryptolocker.exe	31
PID 2256 wrote to memory of 604	2256	2024-09-08_dab04cd27f8a414c4a84505f7104368d_cryptolocker.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-09-08_dab04cd27f8a414c4a84505f7104368d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-08_dab04cd27f8a414c4a84505f7104368d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
75KB

MD5
29498f972f7c77e1150cf33febf174bf

SHA1
c3fe1f87a5e51da1a12b519e35a91d8ea56f3920

SHA256
00ffb8d2914befcec1430740296da3464ffdf3095ede9428f9e7ff0c457fe3d7

SHA512
75521b910ce1d9e9092ff26539550bb87c3147d8b88efa37cbbc4ed3b954603c29e4540b1a16f27937025a16786dad28a71a11bc1b04755b8cbcb2a3fcce92ad

Download Submit
memory/604-15-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/604-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2256-1-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/2256-0-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2256-8-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download