46def830f8eddcc6e451efa3938a7bcc769851bc4a6760ef765fa621b4a4ddf4

Analysis

max time kernel
136s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 05:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-08-26_d08dd99ebb5f94e0a48c6d908b5c6f42_cryptolocker_JC.exe
Size

32KB
MD5

d08dd99ebb5f94e0a48c6d908b5c6f42
SHA1

d11cae9814506f7a7fcc4a79405fe9bc69ea6961
SHA256

46def830f8eddcc6e451efa3938a7bcc769851bc4a6760ef765fa621b4a4ddf4
SHA512

f20f6c538e21ffb25d034749727bf699b3ac76c52fc2921f8736760659cc98afe53852a5264db7885d9999ad3ad098eef1425f6a72d5da2c473a96bfc423606e
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBjb1iIJSL:X6QFElP6n+gJQMOtEvwDpjBngHL

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	2023-08-26_d08dd99ebb5f94e0a48c6d908b5c6f42_cryptolocker_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
1568	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 1568	4452	2023-08-26_d08dd99ebb5f94e0a48c6d908b5c6f42_cryptolocker_JC.exe	86
PID 4452 wrote to memory of 1568	4452	2023-08-26_d08dd99ebb5f94e0a48c6d908b5c6f42_cryptolocker_JC.exe	86
PID 4452 wrote to memory of 1568	4452	2023-08-26_d08dd99ebb5f94e0a48c6d908b5c6f42_cryptolocker_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\2023-08-26_d08dd99ebb5f94e0a48c6d908b5c6f42_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-26_d08dd99ebb5f94e0a48c6d908b5c6f42_cryptolocker_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
32KB

MD5
ebe890f8cfe71065590abdb5fc2c9d59

SHA1
7fe2d9017fb26939ceff5ed9ca5d310ef9fc19e9

SHA256
79fa4afb0967526db64a078893ed8ad3354c9dfd74e88c95d595a8f94fac523c

SHA512
f22ef266e62bc7344e49d119ce4c20fe0316636d77a820530fff5ad64c3bc4a5b17ae2469846f73715fbb3dbcb26febaf42e6fc40cee8d288adae1cb2ba4f10d

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
32KB

MD5
ebe890f8cfe71065590abdb5fc2c9d59

SHA1
7fe2d9017fb26939ceff5ed9ca5d310ef9fc19e9

SHA256
79fa4afb0967526db64a078893ed8ad3354c9dfd74e88c95d595a8f94fac523c

SHA512
f22ef266e62bc7344e49d119ce4c20fe0316636d77a820530fff5ad64c3bc4a5b17ae2469846f73715fbb3dbcb26febaf42e6fc40cee8d288adae1cb2ba4f10d

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
32KB

MD5
ebe890f8cfe71065590abdb5fc2c9d59

SHA1
7fe2d9017fb26939ceff5ed9ca5d310ef9fc19e9

SHA256
79fa4afb0967526db64a078893ed8ad3354c9dfd74e88c95d595a8f94fac523c

SHA512
f22ef266e62bc7344e49d119ce4c20fe0316636d77a820530fff5ad64c3bc4a5b17ae2469846f73715fbb3dbcb26febaf42e6fc40cee8d288adae1cb2ba4f10d

Download Submit
memory/4452-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4452-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4452-2-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download