Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/10/2024, 03:53
Behavioral task
behavioral1
Sample
2024-10-12_9f69269fd490a58348b01a2f643183ed_cryptolocker.exe
Resource
win7-20240903-en
General
-
Target
2024-10-12_9f69269fd490a58348b01a2f643183ed_cryptolocker.exe
-
Size
92KB
-
MD5
9f69269fd490a58348b01a2f643183ed
-
SHA1
f6bbce35ee108d86f724ce431880a56eeeb1cc66
-
SHA256
23ea87aa549f2fb1cc9b504a5abc5a7243fe57194c84a21231c75dd3e2aed2c7
-
SHA512
5141aaf2e6326e229327805a9e49939ee08f46f570c88d63cfc2bf6e28cdab9179f43b379de055b21ef7e932b10f152a53ab4b115f2f1239e9e8b0b72afd189d
-
SSDEEP
1536:n6QFElP6n+g9u9cvMOtEvwDpjYYTjipvF2bx1PQAeC:n6a+1SEOtEvwDpjYYvQd2P7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2944 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 2268 2024-10-12_9f69269fd490a58348b01a2f643183ed_cryptolocker.exe -
resource yara_rule behavioral1/memory/2268-0-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/files/0x000e00000001228d-11.dat upx behavioral1/memory/2268-14-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/2944-17-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/2944-26-0x0000000000500000-0x0000000000510000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-12_9f69269fd490a58348b01a2f643183ed_cryptolocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asih.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2268 wrote to memory of 2944 2268 2024-10-12_9f69269fd490a58348b01a2f643183ed_cryptolocker.exe 31 PID 2268 wrote to memory of 2944 2268 2024-10-12_9f69269fd490a58348b01a2f643183ed_cryptolocker.exe 31 PID 2268 wrote to memory of 2944 2268 2024-10-12_9f69269fd490a58348b01a2f643183ed_cryptolocker.exe 31 PID 2268 wrote to memory of 2944 2268 2024-10-12_9f69269fd490a58348b01a2f643183ed_cryptolocker.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_9f69269fd490a58348b01a2f643183ed_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_9f69269fd490a58348b01a2f643183ed_cryptolocker.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD556749bba1c708dd7809b181696fb56d2
SHA1780b632d98f2c88ad14353cb1258811a61b376ef
SHA256e0c8f1a8092f06c032933fae0548929699a29b25599b618f59f2b4fab0aec1b8
SHA5121947fbb085a2f7ba1c4181fdd60e1d8d78cec1352ad66ca54f25e7829327b0a3febf935b8a39113349e75fd4aff017eea7f24acf0dbac1a7474fac1ee31c8382