a7ba533cdf90497ca06d0dd926b10665cd438c27c0c64dfa39e71f8c66153001

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
23/09/2023, 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-08-26_350a9acc0709776bd14f1a45e61ecd05_cryptolocker_JC.exe
Size

42KB
MD5

350a9acc0709776bd14f1a45e61ecd05
SHA1

6d33f9d870990c143605e927dcebcdc5284cd51d
SHA256

a7ba533cdf90497ca06d0dd926b10665cd438c27c0c64dfa39e71f8c66153001
SHA512

00234da9797acb974a6b4e2aa1bee6ffb06ac134449aab3591d9b7f60494772359b4f886861d69accda3002dbb1396518b5c7c74bc53c8f8a33f26c00090913e
SSDEEP

768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05k:qmbhXDmjr5MOtEvwDpj5cDtKkQZQk

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	2023-08-26_350a9acc0709776bd14f1a45e61ecd05_cryptolocker_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
2208	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 2208	4544	2023-08-26_350a9acc0709776bd14f1a45e61ecd05_cryptolocker_JC.exe	90
PID 4544 wrote to memory of 2208	4544	2023-08-26_350a9acc0709776bd14f1a45e61ecd05_cryptolocker_JC.exe	90
PID 4544 wrote to memory of 2208	4544	2023-08-26_350a9acc0709776bd14f1a45e61ecd05_cryptolocker_JC.exe	90

C:\Users\Admin\AppData\Local\Temp\2023-08-26_350a9acc0709776bd14f1a45e61ecd05_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-26_350a9acc0709776bd14f1a45e61ecd05_cryptolocker_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
42KB

MD5
a69c8dc6b611e0c6736341fe0c6bc8b4

SHA1
32195d11078601a4e03f3cda2acd1e4bb26206fe

SHA256
d0eaf9ea1d1606fb78be4a5a83c7c73696f138da71b665b99a2acb9f6b46e84f

SHA512
3edab409706aff24fa740cb162231f5253591ec10365d10ed9136e098f645cf77671babbfe1c04b79b2744fcef3d70dd6bb6a54ff6c3dbfcf1e5c46df7165ef6

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
42KB

MD5
a69c8dc6b611e0c6736341fe0c6bc8b4

SHA1
32195d11078601a4e03f3cda2acd1e4bb26206fe

SHA256
d0eaf9ea1d1606fb78be4a5a83c7c73696f138da71b665b99a2acb9f6b46e84f

SHA512
3edab409706aff24fa740cb162231f5253591ec10365d10ed9136e098f645cf77671babbfe1c04b79b2744fcef3d70dd6bb6a54ff6c3dbfcf1e5c46df7165ef6

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
42KB

MD5
a69c8dc6b611e0c6736341fe0c6bc8b4

SHA1
32195d11078601a4e03f3cda2acd1e4bb26206fe

SHA256
d0eaf9ea1d1606fb78be4a5a83c7c73696f138da71b665b99a2acb9f6b46e84f

SHA512
3edab409706aff24fa740cb162231f5253591ec10365d10ed9136e098f645cf77671babbfe1c04b79b2744fcef3d70dd6bb6a54ff6c3dbfcf1e5c46df7165ef6

Download Submit
memory/2208-25-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4544-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4544-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4544-2-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4544-3-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/4544-24-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download