7336091c6de5f05b3117fe16bb39440965ed009161dc3f3ff384acb35a07b88c

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
30/08/2023, 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea938dbc77c93853422f2f62c1e59e58_cryptolocker_JC.exe
Size

47KB
MD5

ea938dbc77c93853422f2f62c1e59e58
SHA1

f67667099189061936b36e5dbe1bae0b1a232915
SHA256

7336091c6de5f05b3117fe16bb39440965ed009161dc3f3ff384acb35a07b88c
SHA512

b7343536b079e9d6018eb9ceee1362d5b98856be95b42a9b05545f267010e82eed4c4b6c81c20c51d69edbc64ee2a696702ee9afb06cccb39f74b5cb24366b1c
SSDEEP

768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05RKb6F5e:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKbH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Control Panel\International\Geo\Nation	ea938dbc77c93853422f2f62c1e59e58_cryptolocker_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
4908	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 4908	1528	ea938dbc77c93853422f2f62c1e59e58_cryptolocker_JC.exe	82
PID 1528 wrote to memory of 4908	1528	ea938dbc77c93853422f2f62c1e59e58_cryptolocker_JC.exe	82
PID 1528 wrote to memory of 4908	1528	ea938dbc77c93853422f2f62c1e59e58_cryptolocker_JC.exe	82

C:\Users\Admin\AppData\Local\Temp\ea938dbc77c93853422f2f62c1e59e58_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\ea938dbc77c93853422f2f62c1e59e58_cryptolocker_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
47KB

MD5
8623fea89339052eb728e1f43f502da4

SHA1
0545163cead41079178e6540a3caff438194ac7f

SHA256
7778e8957572c5a69c081065b9eb0f3e60b068e261213157cff1a261895b4d97

SHA512
65cb883b7d1dc5a9372930799702d705033940e2c8dbbff3bc9216f9dda982d0d47fbba9c5958ab1523f4d3d92ab2afa92a5aed8a3d258457cd0ba8f09e7c06f

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
47KB

MD5
8623fea89339052eb728e1f43f502da4

SHA1
0545163cead41079178e6540a3caff438194ac7f

SHA256
7778e8957572c5a69c081065b9eb0f3e60b068e261213157cff1a261895b4d97

SHA512
65cb883b7d1dc5a9372930799702d705033940e2c8dbbff3bc9216f9dda982d0d47fbba9c5958ab1523f4d3d92ab2afa92a5aed8a3d258457cd0ba8f09e7c06f

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
47KB

MD5
8623fea89339052eb728e1f43f502da4

SHA1
0545163cead41079178e6540a3caff438194ac7f

SHA256
7778e8957572c5a69c081065b9eb0f3e60b068e261213157cff1a261895b4d97

SHA512
65cb883b7d1dc5a9372930799702d705033940e2c8dbbff3bc9216f9dda982d0d47fbba9c5958ab1523f4d3d92ab2afa92a5aed8a3d258457cd0ba8f09e7c06f

Download Submit
memory/1528-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1528-1-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/1528-2-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/1528-3-0x00000000006E0000-0x00000000006E6000-memory.dmp

Filesize
24KB

Download
memory/1528-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4908-19-0x0000000002110000-0x0000000002116000-memory.dmp

Filesize
24KB

Download
memory/4908-20-0x00000000020E0000-0x00000000020E6000-memory.dmp

Filesize
24KB

Download
memory/4908-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download