e7f0c519b756968a4b9e70680bba1a2da127f5ba0f061a3e438895b4ae28e2df

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 09:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_4ed07447003ff1d680b4085fba343a17_cryptolocker_elex.exe
Size 86KB
Sample260807-k6ws9sfa22
SHA256 e7f0c519b756968a4b9e70680bba1a2da127f5ba0f061a3e438895b4ae28e2df
MD5 4ed07447003ff1d680b4085fba343a17
SHA1 d083e6bebb77f88c6f841fc8958609cb4ac377eb
SHA512 dc47a3a8be2337e6b262672142e24635b9ea601170f397f87b30d7d3133aacec941e94bb873c17692aa8b1dde939b3311a6ef457904d40d4af7b867e0623e988
SSDEEP 1536:Z6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwMgR:Z6a+pOtEvwDpjtzV
TLSH
T11F83E8326EC50973D5B387B1C9FB82B3A812BD663731498F5489FB014D33786A9A1D0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000001b86d-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000001b86d-12.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
4880	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_4ed07447003ff1d680b4085fba343a17_cryptolocker_elex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\BDB1B93CD5978D45C6261455F8DB95C75AD153AF	asih.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\BDB1B93CD5978D45C6261455F8DB95C75AD153AF\Blob = 5c00000001000000040000008001000062000000010000002000000069729b8e15a86efc177a57afb7171dfc64add28c2fca8cf1507e34453ccb14700b000000010000001a0000004900530052004700200052006f006f0074002000580032000000090000000100000016000000301406082b0601050507030206082b060105050703011400000001000000140000007c4296aede4b483bfa92f89e8ccf6d8ba97237951d0000000100000010000000e3b494871af5dc80ac5089a40ec3c4c7030000000100000014000000bdb1b93cd5978d45c6261455f8db95c75ad153af20000000010000001f0200003082021b308201a1a003020102021041d29dd172eaeea780c12c6ce92f8752300a06082a8648ce3d040303304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205832301e170d3230303930343030303030305a170d3430303931373136303030305a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f742058323076301006072a8648ce3d020106052b8104002203620004cd9bd59f80830aec094af3164a3e5ccf77acde67050d1d07b6dc16fb5a8b14dbe27160c4ba459511898eea06dff72a161ca4b9c5c532e003e01e8218388bd745d80a6a6ee60077fb02517d22d80a6e9a5b77dff0fa41ec39dc75ca68070c1feaa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604147c4296aede4b483bfa92f89e8ccf6d8ba9723795300a06082a8648ce3d040303036800306502307b794e465084c24487461b4570ff5899def4fda4d255a6202d74d634bc41a3505f012756b4be277506af122e75988dfc0231008bf5776cd4c865aae00b2cee149d2737a4f953a551e42983d7f890315b429f0af5feae0068e78c490fb66f5b5b15f2e7	asih.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 4880	548	2026-08-07_4ed07447003ff1d680b4085fba343a17_cryptolocker_elex.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-07_4ed07447003ff1d680b4085fba343a17_cryptolocker_elex.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_4ed07447003ff1d680b4085fba343a17_cryptolocker_elex.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:548
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:4880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

asih.exe

Path C:\Users\Admin\AppData\Local\Temp\asih.exe
Size 86KB
SHA256 b417cbec10784fd17178ee719ad45f97a66333997c75810db0820221f7781d68
MD5 79ecc78672b89106bf1d0dbcd9f20765
SHA1 4e5e11148cd8609c6228f4356d53f82da9bb05cd
SHA512 7f9b7c8c2ac17a79180d8ed1165be6aaae3aa158851666a25ce2943d3eab2f0eb5c769f860e6a74fd624c9e03b6df849530db3d33377a9fb9aa866cac0932adb
SSDEEP 1536:Z6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwMgE:Z6a+pOtEvwDpjtzA
TLSH
T15B83E9326EC50973D5B387B1C9FB82B3A422BD663631498F54C9FB014D33786A9A1D0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/548-0-0x0000000000710000-0x0000000000716000-memory.dmp

Download

memory/548-1-0x0000000000710000-0x0000000000716000-memory.dmp

Download

memory/548-2-0x0000000000730000-0x0000000000736000-memory.dmp

Download

memory/4880-24-0x00000000006D0000-0x00000000006D6000-memory.dmp

Download

memory/4880-18-0x0000000002090000-0x0000000002096000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads