96d67323ac776056b00a32d62eca168d67e0f03d090d26cc0c09ecedb0c62ba4

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 04:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-25_80cd97655579e8c2be216c0efb801106_cryptolocker.exe
Size

78KB
MD5

80cd97655579e8c2be216c0efb801106
SHA1

4b8f277420072423fe810bf133974bc996df1f2e
SHA256

96d67323ac776056b00a32d62eca168d67e0f03d090d26cc0c09ecedb0c62ba4
SHA512

6ea3fa8ad726ce4394b3563f8cf40eab9f54c13b8093b462facd9141270abb991420c357243ee34ebb7a41bbdc0c9511842107c4989c2b12185d1591c3ee5045
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1siYYJ:X6a+SOtEvwDpjBZYvQd2Z

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3044	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1860	2024-09-25_80cd97655579e8c2be216c0efb801106_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-25_80cd97655579e8c2be216c0efb801106_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 3044	1860	2024-09-25_80cd97655579e8c2be216c0efb801106_cryptolocker.exe	28
PID 1860 wrote to memory of 3044	1860	2024-09-25_80cd97655579e8c2be216c0efb801106_cryptolocker.exe	28
PID 1860 wrote to memory of 3044	1860	2024-09-25_80cd97655579e8c2be216c0efb801106_cryptolocker.exe	28
PID 1860 wrote to memory of 3044	1860	2024-09-25_80cd97655579e8c2be216c0efb801106_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-09-25_80cd97655579e8c2be216c0efb801106_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-25_80cd97655579e8c2be216c0efb801106_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
78KB

MD5
e7f52db5ee61c9a75e164b99326b7988

SHA1
f3c329357743a8d26e4c29536853673abbbee434

SHA256
d63512245a52039e257c18f7eb7a6bb0d18cae5052b382a542753a6bc0427244

SHA512
5e7736d7963e9fb74462178216919a277b316ed04ea1e543b043791607485be37686903205a3dfbb140bba31a9291e93352ddd9d359a1c3a5c1f7574be10f812

Download Submit
memory/1860-0-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/1860-8-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/1860-1-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/3044-15-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/3044-22-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download