5466dfd4632d7e2db202fc1662a8bb37856990d5bbd7fb845b2c25b6f3186595

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-02_3493031e46a3c5eb3a13a788b3d517ce_cryptolocker.exe
Size

58KB
MD5

3493031e46a3c5eb3a13a788b3d517ce
SHA1

0cbbab46b52c75ad2ede328c95dd37c6cf32c439
SHA256

5466dfd4632d7e2db202fc1662a8bb37856990d5bbd7fb845b2c25b6f3186595
SHA512

4a0090dbbc9c01d93af54ed896cb65592f5bd5af7968b562d60d041f418af83267e76e2eb0c6aa6eade4282df48bd47e24db4e120082ce145aab3ba691bc88bf
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjyaLccCKdulcrJuP:V6a+pOtEvwDpjv9a

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2648	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1780	2024-10-02_3493031e46a3c5eb3a13a788b3d517ce_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-02_3493031e46a3c5eb3a13a788b3d517ce_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2648	1780	2024-10-02_3493031e46a3c5eb3a13a788b3d517ce_cryptolocker.exe	29
PID 1780 wrote to memory of 2648	1780	2024-10-02_3493031e46a3c5eb3a13a788b3d517ce_cryptolocker.exe	29
PID 1780 wrote to memory of 2648	1780	2024-10-02_3493031e46a3c5eb3a13a788b3d517ce_cryptolocker.exe	29
PID 1780 wrote to memory of 2648	1780	2024-10-02_3493031e46a3c5eb3a13a788b3d517ce_cryptolocker.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-10-02_3493031e46a3c5eb3a13a788b3d517ce_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-02_3493031e46a3c5eb3a13a788b3d517ce_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
58KB

MD5
440353c191cccb085a7647f73eddcd9e

SHA1
f89268984f74c1a298cb82cbf677652e08e77be7

SHA256
6050331230ddb75b4b2290dd4aea82bca0c87752ae5bbf952eae9ce1c3ccffc8

SHA512
699a5fa3f16fea758ddb7cdd55bcb75491c1dac47e90b2bc41b319b316958d3d82c0ac67c8d3b74c9c9782223f1ed3503272f97a361c01e93b5a8e819549c252

Download Submit
memory/1780-8-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/1780-1-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/1780-0-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2648-15-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2648-22-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download