7aae46c25c74d4e8707bef2181a14c5faac4b2bae5eeeaedbd6d55ddb12537f7

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-20_4e1746924c53eaebda7c94e12f341d0c_cryptolocker.exe
Size

32KB
MD5

4e1746924c53eaebda7c94e12f341d0c
SHA1

3d49ec91862500f11f03f769781639ed40d1094c
SHA256

7aae46c25c74d4e8707bef2181a14c5faac4b2bae5eeeaedbd6d55ddb12537f7
SHA512

55f1c8233bda6357353f3d65fbe4ee10f72c39c91582f3b304db57b706380f80731d535cb327578e52c093eb6d17993197f40e0298cb7f8a0a9349d5f6a88610
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjB9iNL3:X6QFElP6n+gJQMOtEvwDpjBG

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2296	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
392	2024-11-20_4e1746924c53eaebda7c94e12f341d0c_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-20_4e1746924c53eaebda7c94e12f341d0c_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 2296	392	2024-11-20_4e1746924c53eaebda7c94e12f341d0c_cryptolocker.exe	29
PID 392 wrote to memory of 2296	392	2024-11-20_4e1746924c53eaebda7c94e12f341d0c_cryptolocker.exe	29
PID 392 wrote to memory of 2296	392	2024-11-20_4e1746924c53eaebda7c94e12f341d0c_cryptolocker.exe	29
PID 392 wrote to memory of 2296	392	2024-11-20_4e1746924c53eaebda7c94e12f341d0c_cryptolocker.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-11-20_4e1746924c53eaebda7c94e12f341d0c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-20_4e1746924c53eaebda7c94e12f341d0c_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:392
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
32KB

MD5
aea10877b2dd005fffa4596dcc6f8c4c

SHA1
be68120497d87f0090cd49baa3d7ef88a9b3b1db

SHA256
26192a8038982182c49cd1646f41044ad570e4c6ce133e1edce385556dc7c648

SHA512
fa08f9107c0896415dda7601e3901b3268c8edadca14d472417afbda3e13290822f420b723cb5388e63a88f5284af5779193da795b82d3e73c76034b53970b69

Download Submit
memory/392-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/392-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/392-1-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2296-22-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/2296-15-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download