43cd283f020bb1b46e5ba7cce375c1bf0aff6aecb8b9206fe3d2dd20478fcf8c

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 03:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-12_cbb75538348cec659c5ec9a757db8465_cryptolocker.exe
Size

36KB
MD5

cbb75538348cec659c5ec9a757db8465
SHA1

88b1ba4d77972ac6057fe25a774a01d01cc4ba13
SHA256

43cd283f020bb1b46e5ba7cce375c1bf0aff6aecb8b9206fe3d2dd20478fcf8c
SHA512

f0d2b1b96f5f44463102e66b0f95c1abdb60e4914b82ef89a873bc73a44a4fc9db641d7f9b129ef211094ab112bc3e5a9a0a93d29272cbd2ac65ba3ff82eccbf
SSDEEP

768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITB:qDdFJy3QMOtEvwDpjjWMl7TB

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2240	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2492	2024-10-12_cbb75538348cec659c5ec9a757db8465_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2492-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x0008000000012102-11.dat	upx
behavioral1/memory/2492-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2240-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2240-27-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-12_cbb75538348cec659c5ec9a757db8465_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2240	2492	2024-10-12_cbb75538348cec659c5ec9a757db8465_cryptolocker.exe	30
PID 2492 wrote to memory of 2240	2492	2024-10-12_cbb75538348cec659c5ec9a757db8465_cryptolocker.exe	30
PID 2492 wrote to memory of 2240	2492	2024-10-12_cbb75538348cec659c5ec9a757db8465_cryptolocker.exe	30
PID 2492 wrote to memory of 2240	2492	2024-10-12_cbb75538348cec659c5ec9a757db8465_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-10-12_cbb75538348cec659c5ec9a757db8465_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-12_cbb75538348cec659c5ec9a757db8465_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
36KB

MD5
479e30ca8b0c0459f29233b4a2e8ef39

SHA1
7e6f6694c44e7d2941a8464ece688d0333873b51

SHA256
8dfecf02e1f2e182c62c999dda2e731471fdfd32293897d8b6bb4dafc7724eca

SHA512
57b5998dcc401765c999f1fabf69110f2983511e2ed5283c9aa235c63155f4681d1b54770ce6ad8ffe7b80abab92152eda1b2198525db1ba2667248b36c53db7

Download Submit
memory/2240-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2240-19-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2240-26-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2240-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2492-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2492-2-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2492-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2492-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2492-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download