fc591dc0c0e99ba8f82a083af426d783713890f6fd5041a32fe47d18c969df41

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-09_2a46459644a51d864b37f1128df45bc9_cryptolocker.exe
Size

60KB
MD5

2a46459644a51d864b37f1128df45bc9
SHA1

7a0f22074cbebb8c71531b6e52b9aec0e225bae8
SHA256

fc591dc0c0e99ba8f82a083af426d783713890f6fd5041a32fe47d18c969df41
SHA512

afa817c46924ddab403541639cb040b8ead51dd0a03e6b7f623ee541c31113f1de8fd5729ec855331176bdaeb48561ffab8d58e007b920f23f3519b48fbd0be7
SSDEEP

768:H6LsoEEeegiZPvEhHSG+gk5NQXtckstOOtEvwDpjhBaD3TUogs/VXpAP3qqT:H6QFElP6n+gou9cvMOtEvwDpjCpVXh0

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2732	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2400	2024-09-09_2a46459644a51d864b37f1128df45bc9_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2400-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2732-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2400-15-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x000b000000012280-14.dat	upx
behavioral1/memory/2732-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-09_2a46459644a51d864b37f1128df45bc9_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2732	2400	2024-09-09_2a46459644a51d864b37f1128df45bc9_cryptolocker.exe	30
PID 2400 wrote to memory of 2732	2400	2024-09-09_2a46459644a51d864b37f1128df45bc9_cryptolocker.exe	30
PID 2400 wrote to memory of 2732	2400	2024-09-09_2a46459644a51d864b37f1128df45bc9_cryptolocker.exe	30
PID 2400 wrote to memory of 2732	2400	2024-09-09_2a46459644a51d864b37f1128df45bc9_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-09-09_2a46459644a51d864b37f1128df45bc9_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-09_2a46459644a51d864b37f1128df45bc9_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
60KB

MD5
1ccc3bff1a712a61a78ee4fd4d98ea1a

SHA1
f0b0b32c2565ed0739e042051bb7173a8c1df2d0

SHA256
a6aa5475a3759d3d8fc47988632bffa5800dc9e03cef9afd5dd169079f50e665

SHA512
d52bd6c34ebbad44a2c6565b78439690cd1c493b3d085d692291328ea4d4d36c823cff07cc1a6eff684dac9d6b38d59f131dc2884086e9fb8b4c711863608490

Download Submit
memory/2400-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2400-2-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/2400-9-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2400-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2400-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2732-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2732-25-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2732-18-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2732-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download