d651ab98414a6812f2cac68eec0cf7e991f3e006ccc38629d912d73982ca839f

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 03:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-15_4643fb186f57ca57b77d4d3a130cbcae_cryptolocker.exe
Size

92KB
MD5

4643fb186f57ca57b77d4d3a130cbcae
SHA1

f0a8d29f401f4378fcb7c824e754565ab4196c68
SHA256

d651ab98414a6812f2cac68eec0cf7e991f3e006ccc38629d912d73982ca839f
SHA512

c233f69c157f6922cb2938acfa139e3db3e6eb48462ba548142aa8994e4a13ff56d68c8fefe1b4391c5cf17c702f1ce9cd244272944e8b1bca5b7f6cb1bfe68c
SSDEEP

1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgddBM:AnBdOOtEvwDpj6zK

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2716	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2736	2024-09-15_4643fb186f57ca57b77d4d3a130cbcae_cryptolocker.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2736-0-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/files/0x000a000000012283-11.dat	upx
behavioral1/memory/2736-16-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/memory/2716-26-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-15_4643fb186f57ca57b77d4d3a130cbcae_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2716	2736	2024-09-15_4643fb186f57ca57b77d4d3a130cbcae_cryptolocker.exe	30
PID 2736 wrote to memory of 2716	2736	2024-09-15_4643fb186f57ca57b77d4d3a130cbcae_cryptolocker.exe	30
PID 2736 wrote to memory of 2716	2736	2024-09-15_4643fb186f57ca57b77d4d3a130cbcae_cryptolocker.exe	30
PID 2736 wrote to memory of 2716	2736	2024-09-15_4643fb186f57ca57b77d4d3a130cbcae_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-09-15_4643fb186f57ca57b77d4d3a130cbcae_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-15_4643fb186f57ca57b77d4d3a130cbcae_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
92KB

MD5
371346a0455fdd2c32fc55964b3c4d87

SHA1
613b762451a918836607c6654c7e69199c9b97aa

SHA256
e4a80482d0c31a6244b5dc5a0691d04b638d0d6b703bfd54963a0160cc46fa03

SHA512
d12ccce985319146a3d5ac7aa9ddcf5c30d985f3d5961b6cd6c20035bbdab6adca2616e67351da6b43044c8ab6844f88aed9a9104dc7007fa652de57e956cd50

Download Submit
memory/2716-18-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download
memory/2716-25-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2716-26-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2736-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2736-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2736-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2736-2-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2736-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download