27659a8fe0556cbd94e18afc82ed87e2c19cfb9eec786328dd4d0f843c4aedce

Analysis

max time kernel
149s
max time network
142s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-13_6fdf7ee65076640eab0dbef398a660d8_cryptolocker.exe
Size

73KB
MD5

6fdf7ee65076640eab0dbef398a660d8
SHA1

30823e39d43eead8762e7a25831ff40dfd42022a
SHA256

27659a8fe0556cbd94e18afc82ed87e2c19cfb9eec786328dd4d0f843c4aedce
SHA512

1b821e667ec7936ec4fe06f60497f887cd0d52159d895a11c8a076619bfeb256cdfd42eefca222e42d434d7c76e4a8942831ae81980f327712a23dc0adc0a81b
SSDEEP

1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKUNZO5B:DW60sllyWOtEvwDpjwF85Q

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3052	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2500	2024-10-13_6fdf7ee65076640eab0dbef398a660d8_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-13_6fdf7ee65076640eab0dbef398a660d8_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 3052	2500	2024-10-13_6fdf7ee65076640eab0dbef398a660d8_cryptolocker.exe	30
PID 2500 wrote to memory of 3052	2500	2024-10-13_6fdf7ee65076640eab0dbef398a660d8_cryptolocker.exe	30
PID 2500 wrote to memory of 3052	2500	2024-10-13_6fdf7ee65076640eab0dbef398a660d8_cryptolocker.exe	30
PID 2500 wrote to memory of 3052	2500	2024-10-13_6fdf7ee65076640eab0dbef398a660d8_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-10-13_6fdf7ee65076640eab0dbef398a660d8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-13_6fdf7ee65076640eab0dbef398a660d8_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
73KB

MD5
e28962f2edd2a2269d247905b0e0bf0d

SHA1
bf252df3b8cc1a4e1d3e6ea25eacd935b225d592

SHA256
15a303073a001ab13c0bb4732b65c8a8082e7b59cb85d889c9d2b9073d3b05eb

SHA512
691104678ffed4eeb48c41d81a1ccd1fc5687d9d24939bbbd5342254df7eee791dad15ff48d6e8dab9c6cab6a5bfc30def0665d8dacd9be12b56f6388d216a4e

Download Submit
memory/2500-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2500-1-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2500-2-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2500-3-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2500-15-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/3052-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/3052-18-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/3052-19-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/3052-26-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download