1abff6a3874ee79411b558b51534fcbdd5372756237014f255a81128ff238151

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/03/2025, 08:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-21_04f74a41da8087182c1331038485b65d_cryptolocker.exe
Size

90KB
MD5

04f74a41da8087182c1331038485b65d
SHA1

dfcd96c4c04f1739780c38e3ae817562bcccf488
SHA256

1abff6a3874ee79411b558b51534fcbdd5372756237014f255a81128ff238151
SHA512

13f57253521166f0a520970571be4125e6f04f88256164de30565db297a2a62115ed93c144b7f0e5874d7059e9d80a885626e36d69646dba887db5a31e1cb319
SSDEEP

1536:Z6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwMgcfn:Z6a+pOtEvwDpjtzu

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2812	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1400	2025-03-21_04f74a41da8087182c1331038485b65d_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-21_04f74a41da8087182c1331038485b65d_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2812	1400	2025-03-21_04f74a41da8087182c1331038485b65d_cryptolocker.exe	31
PID 1400 wrote to memory of 2812	1400	2025-03-21_04f74a41da8087182c1331038485b65d_cryptolocker.exe	31
PID 1400 wrote to memory of 2812	1400	2025-03-21_04f74a41da8087182c1331038485b65d_cryptolocker.exe	31
PID 1400 wrote to memory of 2812	1400	2025-03-21_04f74a41da8087182c1331038485b65d_cryptolocker.exe	31

C:\Users\Admin\AppData\Local\Temp\2025-03-21_04f74a41da8087182c1331038485b65d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-21_04f74a41da8087182c1331038485b65d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
fcee5da1859dde88f7becf3baa24cb51

SHA1
07331148ff69921e15b8e28dcf8cf8cb16ae5c3b

SHA256
a69300259856f83e7b7cbfbf9b6c459687e309177fc31ee840d6e0391d94747a

SHA512
5628939b64f85ea34484059e79cb7232921ae6cae9059086724684bd657b5cc6bb527e45ad997cb38e95d7e97099c3f488d3ed6c84825615e31328986dcc9783

Download Submit
memory/1400-2-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/1400-1-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/1400-0-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2812-15-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2812-22-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download