c300f4d585e7d29afdf96125a182f54e9162cd84a818b08393a3c7b086f6ac75

Analysis

max time kernel
133s
max time network
144s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
01-11-2024 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-01_b4f64609c44c432fe10f62536329c0bb_cryptolocker.exe
Size

57KB
MD5

b4f64609c44c432fe10f62536329c0bb
SHA1

fe3607f1c1b0b0544c3deba759107ffe35538333
SHA256

c300f4d585e7d29afdf96125a182f54e9162cd84a818b08393a3c7b086f6ac75
SHA512

6f4ffe84954980423b64a7f7d2edb9b6e4acddd1f33978988c70a7d85a8d74c16d5657d07fae1094ec53a7a7d44c2d91b142fe209094b183f350ded20b81dcf1
SSDEEP

768:P8mnjO6LsoEEeegiZPvEhHSG+gbum/kLyMro2GtOOtEvwDpjKvWxHCbSVaU8:P8mnK6QFElP6n+gymddpMOtEvwDpjYB

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

1936 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-11-01_b4f64609c44c432fe10f62536329c0bb_cryptolocker.exe

pid process

1832 2024-11-01_b4f64609c44c432fe10f62536329c0bb_cryptolocker.exe

pid	process
1936	asih.exe

pid	process
1832	2024-11-01_b4f64609c44c432fe10f62536329c0bb_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1832-0-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/memory/1832-14-0x0000000000500000-0x000000000050F311-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\asih.exe	upx
behavioral1/memory/1936-16-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/memory/1936-26-0x0000000000500000-0x000000000050F311-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2024-11-01_b4f64609c44c432fe10f62536329c0bb_cryptolocker.exeasih.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-01_b4f64609c44c432fe10f62536329c0bb_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-11-01_b4f64609c44c432fe10f62536329c0bb_cryptolocker.exe

description	pid	process	target process
PID 1832 wrote to memory of 1936	1832	2024-11-01_b4f64609c44c432fe10f62536329c0bb_cryptolocker.exe	asih.exe
PID 1832 wrote to memory of 1936	1832	2024-11-01_b4f64609c44c432fe10f62536329c0bb_cryptolocker.exe	asih.exe
PID 1832 wrote to memory of 1936	1832	2024-11-01_b4f64609c44c432fe10f62536329c0bb_cryptolocker.exe	asih.exe
PID 1832 wrote to memory of 1936	1832	2024-11-01_b4f64609c44c432fe10f62536329c0bb_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-01_b4f64609c44c432fe10f62536329c0bb_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-01_b4f64609c44c432fe10f62536329c0bb_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1832

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
57KB

MD5
e85ff93b728b14f04daa578fad4fda7b

SHA1
d946432148f556a0f175c6b256eb2fdd7b298560

SHA256
309618e7ff57caa68aa7c298e4930af9929e41b1cdf4f432ae8161fe4421832f

SHA512
41a491625354228ac0d3b60a58040c707283339b9e4325e0c9f67344b69079ae7a49ffaaa41798daf2df52d4b76c3ecd5ee64a1e72cfbccc7204b3864f8cc584

Download Submit
memory/1832-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1832-0-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/1832-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1832-2-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/1832-14-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/1936-16-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/1936-25-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1936-18-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/1936-26-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download