a576996691d335fbfaa23be64df556468f929c5a66f06fda88af722a72eca427

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-17_a5af762dd3c9ca5a1900903dbc265158_cryptolocker.exe
Size

61KB
MD5

a5af762dd3c9ca5a1900903dbc265158
SHA1

50af9468eac9203f48e4b8054e58497ccd2491e9
SHA256

a576996691d335fbfaa23be64df556468f929c5a66f06fda88af722a72eca427
SHA512

286a7d679413506f8bad423012d27a46defef29c08491898028ef12a24cb2706a2063ed6ad52611ad2b6626b4e0e5b82794c37409437c19df7033e24a548e7f1
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBccD2RuoNmuBLZ/W:X6a+SOtEvwDpjBrOu

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2480	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2128	2024-10-17_a5af762dd3c9ca5a1900903dbc265158_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-17_a5af762dd3c9ca5a1900903dbc265158_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2480	2128	2024-10-17_a5af762dd3c9ca5a1900903dbc265158_cryptolocker.exe	30
PID 2128 wrote to memory of 2480	2128	2024-10-17_a5af762dd3c9ca5a1900903dbc265158_cryptolocker.exe	30
PID 2128 wrote to memory of 2480	2128	2024-10-17_a5af762dd3c9ca5a1900903dbc265158_cryptolocker.exe	30
PID 2128 wrote to memory of 2480	2128	2024-10-17_a5af762dd3c9ca5a1900903dbc265158_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-10-17_a5af762dd3c9ca5a1900903dbc265158_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-17_a5af762dd3c9ca5a1900903dbc265158_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
61KB

MD5
f396b2fcdaa364d426f9967185e65ebf

SHA1
dbffe7aa281557d4f7274dbaecc5b174e8bafc0f

SHA256
2c820c9451b18dd6b94e9e94958d496e787296ce483ab9dc75fdb5fdce231a6e

SHA512
a40a3c2b3b14caa4d077d67f4445cc93aaf58cc878f18faf78862a7cbc767c7437e290efec5e6219cbed5afbefaf09a9883597bccf04749e970685ec4d2c453e

Download Submit
memory/2128-0-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/2128-8-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/2128-1-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2480-15-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/2480-22-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download