c266c6c685d24dff20deb9056855e85a8480736bebf3b7a8f2550666a1881427

Analysis

max time kernel
132s
max time network
139s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-09-2024 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-15_558038171a49b1a0ad92d272c1a61722_cryptolocker.exe
Size

44KB
MD5

558038171a49b1a0ad92d272c1a61722
SHA1

444a37eb1c72167f9e5649b2cd32c7385425f919
SHA256

c266c6c685d24dff20deb9056855e85a8480736bebf3b7a8f2550666a1881427
SHA512

3837932b932e169c024180d7311de252bf941c84fd2bafa062452dac285a242adeb5300c915b3d154756de6cc53578745158789b57755c1a748e7e8212357ea0
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaac4HK/wSvuQTCyD/95WQqA:X6QFElP6n+gJQMOtEvwDpjBsYK/fbDF/

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2320	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
548	2024-09-15_558038171a49b1a0ad92d272c1a61722_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-15_558038171a49b1a0ad92d272c1a61722_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 2320	548	2024-09-15_558038171a49b1a0ad92d272c1a61722_cryptolocker.exe	31
PID 548 wrote to memory of 2320	548	2024-09-15_558038171a49b1a0ad92d272c1a61722_cryptolocker.exe	31
PID 548 wrote to memory of 2320	548	2024-09-15_558038171a49b1a0ad92d272c1a61722_cryptolocker.exe	31
PID 548 wrote to memory of 2320	548	2024-09-15_558038171a49b1a0ad92d272c1a61722_cryptolocker.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-09-15_558038171a49b1a0ad92d272c1a61722_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-15_558038171a49b1a0ad92d272c1a61722_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:548
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
45KB

MD5
34ac043e7036b08337f4d24d3f4879f1

SHA1
495efbfb59e77e6020b9c96f9a4869f5355f76d2

SHA256
2b8c6de1f6484069e20b8e4ecec5c1c7aadfbc3f0ff958bfc082b3527a126b46

SHA512
f8339912e80a8ee1600e5f300707f212e7a0e1dffa77be5535eed2125086f67f1318a0b1ec50d96a59037b9bd1b773818aa6c54baad1b20a14255a3b782d40e0

Download Submit
memory/548-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/548-1-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/548-8-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2320-22-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2320-15-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download