Analysis
-
max time kernel
141s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
07/11/2024, 15:06
Behavioral task
behavioral1
Sample
2024-11-07_eaad1808e183fb5f0163f828e2ff7e57_cryptolocker.exe
Resource
win7-20240729-en
General
-
Target
2024-11-07_eaad1808e183fb5f0163f828e2ff7e57_cryptolocker.exe
-
Size
34KB
-
MD5
eaad1808e183fb5f0163f828e2ff7e57
-
SHA1
b904a7c534f8127c6cee7879259042760a7bb712
-
SHA256
c6ed3d9abce97509ba3b0e61828235eb1a08f910be4cf5b5b3f940f54cc852ee
-
SHA512
4100ef1f27599e42ccc9e247ac2fbbdf709e12aa15d1ebb95cbfc2669455583ef0e5e2420e184c87418ef84e35df5a719c1ac2ce0b1e1addf37d28978d8a55a4
-
SSDEEP
768:qUmnjFom/kLyMro2GtOOtEvwDpjeMLam5axRVe:qUmnpomddpMOtEvwDpjjaYaQ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2452 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 2488 2024-11-07_eaad1808e183fb5f0163f828e2ff7e57_cryptolocker.exe -
resource yara_rule behavioral1/memory/2488-0-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/files/0x000e00000001418b-11.dat upx behavioral1/memory/2488-15-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral1/memory/2452-25-0x0000000000500000-0x000000000050F000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-11-07_eaad1808e183fb5f0163f828e2ff7e57_cryptolocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asih.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2452 2488 2024-11-07_eaad1808e183fb5f0163f828e2ff7e57_cryptolocker.exe 31 PID 2488 wrote to memory of 2452 2488 2024-11-07_eaad1808e183fb5f0163f828e2ff7e57_cryptolocker.exe 31 PID 2488 wrote to memory of 2452 2488 2024-11-07_eaad1808e183fb5f0163f828e2ff7e57_cryptolocker.exe 31 PID 2488 wrote to memory of 2452 2488 2024-11-07_eaad1808e183fb5f0163f828e2ff7e57_cryptolocker.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-07_eaad1808e183fb5f0163f828e2ff7e57_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-07_eaad1808e183fb5f0163f828e2ff7e57_cryptolocker.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2452
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD56d8f14fee5cc43ffc47288de4fbf2a24
SHA141fc0e27342dc6bd9ab2211a9f29b1c85c3d0b9c
SHA25672b36599910dab1687e4dd3325a1706b2a015741464a5b2ce00e5c84035337a9
SHA5121c0b0cd8d2aa055cdf7220beb76e3dbad435c72a10d9a1bae7d11f7e1277adc51300e4ea449d1147f52efa24467c2850d1e5ec66be0ce57cd668d2d37a68922e