23e471f766c1f5eaceb4409632133d2b1a722a0d6891a0bb394ae4b618870d19

Analysis

max time kernel
131s
max time network
139s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-19_0ed5b1a6fc54faac3ee725b631bfe12d_cryptolocker.exe
Size

68KB
MD5

0ed5b1a6fc54faac3ee725b631bfe12d
SHA1

891c81c356466a9ccfc1373c9afb57245e18ba04
SHA256

23e471f766c1f5eaceb4409632133d2b1a722a0d6891a0bb394ae4b618870d19
SHA512

de01f79ce4117417173fcf5c3ef1e9afada553004a781bf3b9220030384c44500a905dc6562068d59d0c772894d7137f7c064c8fc726c886dbc729b2c6c54348
SSDEEP

1536:z6QFElP6n+gKmddpMOtEvwDpj9aYaFAeBr:z6a+CdOOtEvwDpjQp

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2356	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1984	2024-09-19_0ed5b1a6fc54faac3ee725b631bfe12d_cryptolocker.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1984-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1984-15-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x00080000000120f9-14.dat	upx
behavioral1/memory/2356-25-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-19_0ed5b1a6fc54faac3ee725b631bfe12d_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2356	1984	2024-09-19_0ed5b1a6fc54faac3ee725b631bfe12d_cryptolocker.exe	30
PID 1984 wrote to memory of 2356	1984	2024-09-19_0ed5b1a6fc54faac3ee725b631bfe12d_cryptolocker.exe	30
PID 1984 wrote to memory of 2356	1984	2024-09-19_0ed5b1a6fc54faac3ee725b631bfe12d_cryptolocker.exe	30
PID 1984 wrote to memory of 2356	1984	2024-09-19_0ed5b1a6fc54faac3ee725b631bfe12d_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-09-19_0ed5b1a6fc54faac3ee725b631bfe12d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-19_0ed5b1a6fc54faac3ee725b631bfe12d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
69KB

MD5
62f55fc712ca0835544d4ae02aa7926c

SHA1
43ec67ee602d90fc2877a398459e1b2955944ad1

SHA256
ce519241973ea84930c218167a0cb6cbc06c6fa24050f30561ee4e500fcf6beb

SHA512
647ff92fd09d7339f32c312fe7f3761a5205ffd284c2bc030fd54a50cdae41bce33f61e1e646b3f040b46960614946536a3b4b9d5abf65681c6444cac10f59b0

Download Submit
memory/1984-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1984-1-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/1984-2-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/1984-9-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/1984-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2356-17-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2356-24-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2356-25-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download