2762fc1be7fc7d1e54475a1d2c98494bc03ac2e532510bab3564845a705ae29e

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 08:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-19_db1c94f336da684c6b4926e941cd1e13_cryptolocker.exe
Size

88KB
MD5

db1c94f336da684c6b4926e941cd1e13
SHA1

13ee76e48199f3ffe97b216019b92dc67ab70799
SHA256

2762fc1be7fc7d1e54475a1d2c98494bc03ac2e532510bab3564845a705ae29e
SHA512

21c09e97998b1f201ae5adc6bed9ea4e800d4ee15fdaa15ff4cce92d59ad6faf392bd9b65028b57a9150c76a2229b27c3f27d7bc3cb0cc539196717daabcce21
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjyaLccVNl6aA:V6a+pOtEvwDpjvp0

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
988	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2380	2024-09-19_db1c94f336da684c6b4926e941cd1e13_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-19_db1c94f336da684c6b4926e941cd1e13_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 988	2380	2024-09-19_db1c94f336da684c6b4926e941cd1e13_cryptolocker.exe	29
PID 2380 wrote to memory of 988	2380	2024-09-19_db1c94f336da684c6b4926e941cd1e13_cryptolocker.exe	29
PID 2380 wrote to memory of 988	2380	2024-09-19_db1c94f336da684c6b4926e941cd1e13_cryptolocker.exe	29
PID 2380 wrote to memory of 988	2380	2024-09-19_db1c94f336da684c6b4926e941cd1e13_cryptolocker.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-09-19_db1c94f336da684c6b4926e941cd1e13_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-19_db1c94f336da684c6b4926e941cd1e13_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
88KB

MD5
70b6d70ad8665d1f6da90714b50697ea

SHA1
ab3765ff66b13ae57aeb0bef077090acb185c374

SHA256
41fb6d914fc1f6fc43667636662beddbca316cb44f86ba18ff70de57884bebfd

SHA512
68f8032258ffb43efb40aff126408f35cad393a4a393ecad67faedbe5b2261d124e0ffc0e046c0638ed4ec730f5aecb000944f9837d884940a9f6e91345e4b22

Download Submit
memory/988-15-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/988-22-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2380-1-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2380-8-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2380-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download