90ae594238ea2c517461ce9bfab7c18e1cad8f2a21fdf38c6f66cef668f0aeef

Analysis

max time kernel
0s
max time network
139s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/11/2024, 07:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-21_db446aec98b840cbf19806b545c92d5c_cryptolocker.exe
Size

37KB
MD5

db446aec98b840cbf19806b545c92d5c
SHA1

3300b1a289a4d69fc9ab9b21836bcc0c0a8776f4
SHA256

90ae594238ea2c517461ce9bfab7c18e1cad8f2a21fdf38c6f66cef668f0aeef
SHA512

4e3b160043aa1b58125aff73ae8eb16f634e443cd44854330964e11ea8bf3c1cbce13ba6da8fd745e7de750a86dc77dd059cadcf9790cb6fb3be186e65005087
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpjeJQLI3J7f5/6:V6QFElP6n+gMQMOtEvwDpjeJQyTC

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1188	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
580	2024-11-21_db446aec98b840cbf19806b545c92d5c_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-21_db446aec98b840cbf19806b545c92d5c_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 1188	580	2024-11-21_db446aec98b840cbf19806b545c92d5c_cryptolocker.exe	31
PID 580 wrote to memory of 1188	580	2024-11-21_db446aec98b840cbf19806b545c92d5c_cryptolocker.exe	31
PID 580 wrote to memory of 1188	580	2024-11-21_db446aec98b840cbf19806b545c92d5c_cryptolocker.exe	31
PID 580 wrote to memory of 1188	580	2024-11-21_db446aec98b840cbf19806b545c92d5c_cryptolocker.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-11-21_db446aec98b840cbf19806b545c92d5c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-21_db446aec98b840cbf19806b545c92d5c_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:580
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
37KB

MD5
0da471e7093a588b749048839a28fa65

SHA1
5c70d9aa8c8254dadbc2fcb5c17d9118b706f2b6

SHA256
066a396f779fcfca65b08b3caa302ab08a9f62f5a0e8487249a4ad75eb4cd487

SHA512
9c4ede70d4054acf3c3d033d157a4f1183fa304455c3381603966957491a59e378795310812b509d6254f8f12ad876d06123f371bc606c860c2e050416be7dcd

Download Submit
memory/580-1-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download
memory/580-0-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/580-8-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/1188-22-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1188-15-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download