Analysis

  • max time kernel
    136s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18/09/2024, 22:24

General

  • Target

    2024-09-18_f92e16f1ba08d68416316211db0b321f_cryptolocker.exe

  • Size

    35KB

  • MD5

    f92e16f1ba08d68416316211db0b321f

  • SHA1

    e2efa8d242dcf973f0bf8adbd25da431e7798923

  • SHA256

    d769f48a3dae0b6e19f8d984c8d526dd896981010cf74574f95da33ad735a9e2

  • SHA512

    1a92fce08d7aabdf62d95f401b2da50a96950b88a7a329219a2a7045841009a58a68bfb4c8226d1f9d024109ea636c56bfffdfe3b8548aa7cdee36d38628e16b

  • SSDEEP

    768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLa5U:V6QFElP6n+gMQMOtEvwDpjyam

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-18_f92e16f1ba08d68416316211db0b321f_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-18_f92e16f1ba08d68416316211db0b321f_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2896
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    36KB

    MD5

    9a1ffca4393c55b0456b08908868f358

    SHA1

    40660424c9f2695c7a5a9e4ddff3cca677ec6256

    SHA256

    96560d9634f2f8449f94eff0cf4c02c385386928d5fc9e941d779d418c5adbbf

    SHA512

    c4e8044855799c70364bb30a0de60df378e6ff55cea0127bfc70380bc5d4826d683e580966ead01ac4ee165744af2a6bf86fac19d2069fbaa30894fc6a5790b7

  • memory/2896-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/2896-1-0x00000000004E0000-0x00000000004E6000-memory.dmp

    Filesize

    24KB

  • memory/2896-8-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/2972-15-0x0000000000290000-0x0000000000296000-memory.dmp

    Filesize

    24KB