560b57afe5a12712ebf5ae0cd31fd36550519c236174dba53f55313a24240a98

Analysis

max time kernel
132s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-04_14c65f5e194587f56c0fa6e2b9b65f97_cryptolocker.exe
Size

55KB
MD5

14c65f5e194587f56c0fa6e2b9b65f97
SHA1

a97a367a3bcd7775c9e7409d96de0526b6e189d6
SHA256

560b57afe5a12712ebf5ae0cd31fd36550519c236174dba53f55313a24240a98
SHA512

8e7b3e13b0eb2e69538de43478b08c3dc9ca2636e6a40015c1709244baac6b13aef20c37ad862a155c246df89407fda065bad52fd70c88b5d49d9a6f66ddd836
SSDEEP

1536:z6QFElP6n+gKmddpMOtEvwDpj31ik/9+m:z6a+CdOOtEvwDpjZ

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1672	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2552	2024-10-04_14c65f5e194587f56c0fa6e2b9b65f97_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2552-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x0007000000012119-15.dat	upx
behavioral1/memory/2552-14-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1672-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1672-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-04_14c65f5e194587f56c0fa6e2b9b65f97_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 1672	2552	2024-10-04_14c65f5e194587f56c0fa6e2b9b65f97_cryptolocker.exe	30
PID 2552 wrote to memory of 1672	2552	2024-10-04_14c65f5e194587f56c0fa6e2b9b65f97_cryptolocker.exe	30
PID 2552 wrote to memory of 1672	2552	2024-10-04_14c65f5e194587f56c0fa6e2b9b65f97_cryptolocker.exe	30
PID 2552 wrote to memory of 1672	2552	2024-10-04_14c65f5e194587f56c0fa6e2b9b65f97_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-10-04_14c65f5e194587f56c0fa6e2b9b65f97_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-04_14c65f5e194587f56c0fa6e2b9b65f97_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
55KB

MD5
ffa74a49415f5b256d1547fc877f7fc1

SHA1
fd70ce096432bb6a5a7d0fce0f959683537848a4

SHA256
cff5f6d228ebc6e52834eda646acdeae5febc45497860f5c38d7b8faa327520c

SHA512
960667dfe9a65a2b1d05187c44be5eb5bc188b61fe65367a15b874a5cac96f14a986d536b663556421738820eb5cef401a6b5197c5ec853df5300cf89342c04c

Download Submit
memory/1672-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1672-25-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/1672-18-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/1672-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2552-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2552-2-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2552-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2552-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2552-14-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download