e9b9245debb19dee02b6d196290868d2ef6012677d301e520c367b7febb5d428

Analysis

max time kernel
132s
max time network
139s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 03:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-14_6d8108f4c767933e49134bd3db5d1e12_cryptolocker.exe
Size

40KB
MD5

6d8108f4c767933e49134bd3db5d1e12
SHA1

a271f997fbaa17ad4ed0fd44d1bc15e2b9e135a2
SHA256

e9b9245debb19dee02b6d196290868d2ef6012677d301e520c367b7febb5d428
SHA512

725c3019f32e67023018c68259419bd0284049ecfd6366a69c57cea84a83cc8232623713004130e195572fcd247e7b3483f77a792a8a0b099a361de7c54a58ab
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBVaD3TP7DFCw0xj:X6QFElP6n+gJQMOtEvwDpjBmzDU5xj

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
280	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
548	2024-10-14_6d8108f4c767933e49134bd3db5d1e12_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-14_6d8108f4c767933e49134bd3db5d1e12_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 280	548	2024-10-14_6d8108f4c767933e49134bd3db5d1e12_cryptolocker.exe	31
PID 548 wrote to memory of 280	548	2024-10-14_6d8108f4c767933e49134bd3db5d1e12_cryptolocker.exe	31
PID 548 wrote to memory of 280	548	2024-10-14_6d8108f4c767933e49134bd3db5d1e12_cryptolocker.exe	31
PID 548 wrote to memory of 280	548	2024-10-14_6d8108f4c767933e49134bd3db5d1e12_cryptolocker.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-10-14_6d8108f4c767933e49134bd3db5d1e12_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-14_6d8108f4c767933e49134bd3db5d1e12_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:548
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
40KB

MD5
70abf4eed3766f332537f2732749751e

SHA1
cf39047b7fe18022d0ce0efb17e591a307dfbf05

SHA256
7480ac2e00a8032ad028012d8c8495ac01027911a7a55536563359c18eec3b6e

SHA512
dd35a761fc198f4526233745d71a861deaeac4a6fcdff9beaae8346957075c1fb5ca20bdb0aac8dc348d767b1bf22c5f709afa0f666c83210780c7894e614fbb

Download Submit
memory/280-22-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/280-15-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/548-1-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/548-0-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/548-8-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download