0c9883223ce72c8550269e0069684a4c9542dd5f3ced53e5a9f765d872f1df18

Analysis

max time kernel
132s
max time network
139s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-10-2024 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-03_de1c52da3a571c00d115aa820a45b959_cryptolocker.exe
Size

56KB
MD5

de1c52da3a571c00d115aa820a45b959
SHA1

2382bc484e0d93ea3669c8341ba31c0763c0636d
SHA256

0c9883223ce72c8550269e0069684a4c9542dd5f3ced53e5a9f765d872f1df18
SHA512

a25740bc24d09e9a88fa2a2233055d2df2a3d0cd570c2025a1b773d394b427dd6f73a3fdcffab936e7449313a328ce24611ff02f73337d4975777732384a7268
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vxmlcaTI7:X6QFElP6n+gJBMOtEvwDpjBtExmlA

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2540	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
3056	2024-10-03_de1c52da3a571c00d115aa820a45b959_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-03_de1c52da3a571c00d115aa820a45b959_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2540	3056	2024-10-03_de1c52da3a571c00d115aa820a45b959_cryptolocker.exe	30
PID 3056 wrote to memory of 2540	3056	2024-10-03_de1c52da3a571c00d115aa820a45b959_cryptolocker.exe	30
PID 3056 wrote to memory of 2540	3056	2024-10-03_de1c52da3a571c00d115aa820a45b959_cryptolocker.exe	30
PID 3056 wrote to memory of 2540	3056	2024-10-03_de1c52da3a571c00d115aa820a45b959_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-10-03_de1c52da3a571c00d115aa820a45b959_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-03_de1c52da3a571c00d115aa820a45b959_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
56KB

MD5
90bb9d8c5b3809659072ced1cf2dc8d0

SHA1
7f545b4a11f02dad4805fd98136051942fe6acbe

SHA256
6bd13ac6d82fb96161b33944b7ead53babb09567b760bac8f73d178477b53b49

SHA512
dee95093550a9872fb99720c556ca279d06137315e6694f7386139e6d38cf1a2731bf4bdc09c57761c5fb18bbf9bf1eba4f51bee02094a6569c2734065d06e46

Download Submit
memory/2540-15-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2540-22-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/3056-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3056-1-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/3056-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download