f23a1a6479c501d434bb2efe4288cb6776b0ebaf072d81844dc246e52370a616

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2023 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-08-22_e18c4f17dd8161c231d8723775dbed27_cryptolocker_JC.exe
Size

48KB
MD5

e18c4f17dd8161c231d8723775dbed27
SHA1

c9899d3cffbd2b801297a35b3da0de0cb4c02175
SHA256

f23a1a6479c501d434bb2efe4288cb6776b0ebaf072d81844dc246e52370a616
SHA512

5089b0a3d3c205d16bd1be4b4072ad1c0e69ba5124eff445c13192a68531ca6f5a4de0e6c17114adb5265f00edb9e39ae384cc2386b85ef65a8922f15d29244b
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpjeJQ7suIlsw92KFXcTDpJs:V6QFElP6n+gMQMOtEvwDpjeJQ7pojaE

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\Control Panel\International\Geo\Nation	2023-08-22_e18c4f17dd8161c231d8723775dbed27_cryptolocker_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
4672	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4672	4436	2023-08-22_e18c4f17dd8161c231d8723775dbed27_cryptolocker_JC.exe	85
PID 4436 wrote to memory of 4672	4436	2023-08-22_e18c4f17dd8161c231d8723775dbed27_cryptolocker_JC.exe	85
PID 4436 wrote to memory of 4672	4436	2023-08-22_e18c4f17dd8161c231d8723775dbed27_cryptolocker_JC.exe	85

C:\Users\Admin\AppData\Local\Temp\2023-08-22_e18c4f17dd8161c231d8723775dbed27_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-22_e18c4f17dd8161c231d8723775dbed27_cryptolocker_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
48KB

MD5
f0ca1fa41db01b82d4bba812192f7a8c

SHA1
889d4327319deac6317bc5720819fb69ff40443e

SHA256
d624578dc6c22c57a21ea3b0bd7f907c54f927fd2cacd39f9b0085cd3c6bcd25

SHA512
7e4651a06eea5e1f32511ce8af829ed37171409a6dd0e6ba2ad193bd0d3543e94f76fcf37ede56cea750ff9d1299074e5030c6346eb49fcae50ec15dbbead5f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
48KB

MD5
f0ca1fa41db01b82d4bba812192f7a8c

SHA1
889d4327319deac6317bc5720819fb69ff40443e

SHA256
d624578dc6c22c57a21ea3b0bd7f907c54f927fd2cacd39f9b0085cd3c6bcd25

SHA512
7e4651a06eea5e1f32511ce8af829ed37171409a6dd0e6ba2ad193bd0d3543e94f76fcf37ede56cea750ff9d1299074e5030c6346eb49fcae50ec15dbbead5f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
48KB

MD5
f0ca1fa41db01b82d4bba812192f7a8c

SHA1
889d4327319deac6317bc5720819fb69ff40443e

SHA256
d624578dc6c22c57a21ea3b0bd7f907c54f927fd2cacd39f9b0085cd3c6bcd25

SHA512
7e4651a06eea5e1f32511ce8af829ed37171409a6dd0e6ba2ad193bd0d3543e94f76fcf37ede56cea750ff9d1299074e5030c6346eb49fcae50ec15dbbead5f3

Download Submit
memory/4436-0-0x0000000002280000-0x0000000002286000-memory.dmp

Filesize
24KB

Download
memory/4436-1-0x0000000002280000-0x0000000002286000-memory.dmp

Filesize
24KB

Download
memory/4436-2-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download
memory/4672-17-0x0000000000640000-0x0000000000646000-memory.dmp

Filesize
24KB

Download
memory/4672-18-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download