2301a1c121db9de1cea61cfe6cd5c9689c77bac2484dca2cd87107a0f7da6e0c

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-13_584059d1301979d6a6dd8e127da90de8_cryptolocker.exe
Size

67KB
MD5

584059d1301979d6a6dd8e127da90de8
SHA1

9a390104041d50bbdf7d133df80815291076dbf9
SHA256

2301a1c121db9de1cea61cfe6cd5c9689c77bac2484dca2cd87107a0f7da6e0c
SHA512

f808de325516274ac89a951ccbb3b9dfa2a2e616691708615d091fa18ba9957d8ed97d41b5449c6a9071058a52e906cc810909dffacea26a7c1a662a98801912
SSDEEP

1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgtsijR:BbdDmjr+OtEvwDpjM88

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2552	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2692	2024-10-13_584059d1301979d6a6dd8e127da90de8_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-13_584059d1301979d6a6dd8e127da90de8_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2552	2692	2024-10-13_584059d1301979d6a6dd8e127da90de8_cryptolocker.exe	31
PID 2692 wrote to memory of 2552	2692	2024-10-13_584059d1301979d6a6dd8e127da90de8_cryptolocker.exe	31
PID 2692 wrote to memory of 2552	2692	2024-10-13_584059d1301979d6a6dd8e127da90de8_cryptolocker.exe	31
PID 2692 wrote to memory of 2552	2692	2024-10-13_584059d1301979d6a6dd8e127da90de8_cryptolocker.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-10-13_584059d1301979d6a6dd8e127da90de8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-13_584059d1301979d6a6dd8e127da90de8_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
67KB

MD5
0dc99be0c28374ae9dc84ac40ae90f69

SHA1
da2a512e9fc4d87b37476bb90a9bdef6111b1dc4

SHA256
08e225b886a795ada1a218beef3bdd34b6e3fc9bd59129fdb40a69e91fac9167

SHA512
c3d1b4a456b1134fbdc134c1c80572485afc899268f696284dec864c74163d7c5e52c23ae10e9e7aeab8909ce2af715d4e2c7432b11449c489f45135088b11b7

Download Submit
memory/2552-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2552-19-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2552-26-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2552-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2692-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2692-2-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2692-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2692-9-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2692-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download