30886d11c43e7fa5b1c59eaa069da3a2d7cc32e2ef241d4651769009f82fc6ac

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-19_ac11831d8b04231061f56716205bbbc4_cryptolocker.exe
Size

43KB
MD5

ac11831d8b04231061f56716205bbbc4
SHA1

ee2fa3772bd78a95fd6a35c8237e080a77f8e2a4
SHA256

30886d11c43e7fa5b1c59eaa069da3a2d7cc32e2ef241d4651769009f82fc6ac
SHA512

439f5a556c9d578c625e80343946e323dbd34e319b5c46feea0a02da673263e02b466315e92b35f969decb7955e577189e36ca5421a577e7832b46f8fdc238fe
SSDEEP

768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkL7vF1T2:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkL2

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1208	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
984	2024-09-19_ac11831d8b04231061f56716205bbbc4_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-19_ac11831d8b04231061f56716205bbbc4_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 1208	984	2024-09-19_ac11831d8b04231061f56716205bbbc4_cryptolocker.exe	29
PID 984 wrote to memory of 1208	984	2024-09-19_ac11831d8b04231061f56716205bbbc4_cryptolocker.exe	29
PID 984 wrote to memory of 1208	984	2024-09-19_ac11831d8b04231061f56716205bbbc4_cryptolocker.exe	29
PID 984 wrote to memory of 1208	984	2024-09-19_ac11831d8b04231061f56716205bbbc4_cryptolocker.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-09-19_ac11831d8b04231061f56716205bbbc4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-19_ac11831d8b04231061f56716205bbbc4_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:984
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
43KB

MD5
f3b853a7707222229e07d4948974357e

SHA1
47518d0bca8ac057f6b8065a3e0b98865dc87efa

SHA256
6561d1acd25923d84b426705b9ac8a3bae91639e4a18ffc72cbb34aa2f692f89

SHA512
ade704a6c28c3eb5845c2ffb153d91bff7afe93a438ae3b7608c631a4b759bd219fde176bf1b4fdd5340979cf6644d4cbb921e978124095e01cc84550aa8ee33

Download Submit
memory/984-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/984-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/984-2-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/984-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/984-15-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1208-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1208-18-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/1208-25-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download