1173900a14a0d9de3390b65df0e77ffe3e719eb58498060055932f50745d2997

Analysis

max time kernel
151s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
23/10/2023, 17:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2023-09-06_51711bbe2594539f5e818bfab630356d_cryptolocker_JC.exe
Size

38KB
MD5

51711bbe2594539f5e818bfab630356d
SHA1

be0a01b0f18e290b09cf6ca16dc70e3465728489
SHA256

1173900a14a0d9de3390b65df0e77ffe3e719eb58498060055932f50745d2997
SHA512

5fe68e68ee66d940a0d872499b390da8e7b1ce53989636e9fe331a3ab3f6fccaac715794d44ea85b040aaa322155f679b33b994d691e51a94659d9b4d0a02219
SSDEEP

768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6j4AYsqSh+DETkegAf:YGzl5wjRQBBOsP1QMOtEvwDpjl39+D+5

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\International\Geo\Nation	NEAS.2023-09-06_51711bbe2594539f5e818bfab630356d_cryptolocker_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
1736	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 1736	4124	NEAS.2023-09-06_51711bbe2594539f5e818bfab630356d_cryptolocker_JC.exe	88
PID 4124 wrote to memory of 1736	4124	NEAS.2023-09-06_51711bbe2594539f5e818bfab630356d_cryptolocker_JC.exe	88
PID 4124 wrote to memory of 1736	4124	NEAS.2023-09-06_51711bbe2594539f5e818bfab630356d_cryptolocker_JC.exe	88

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_51711bbe2594539f5e818bfab630356d_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_51711bbe2594539f5e818bfab630356d_cryptolocker_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
38KB

MD5
31b3afe4ccdb566559b226d6983be81d

SHA1
563dd5b26b711384385b6ffc5bed4c85fb6fa0b4

SHA256
ae305b1abe1be058cd1de62e2f969e35a11d2482c57e2946daa142d2ff0c77bb

SHA512
dcdbf62e6be6df6bed9679e3d14705949ef89f4166df2db45260d21a7a3d8d7dd46c1c910c48561078bf8a1d77094f6f7c63bcc0ec2915f7220c635aea588b62

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
38KB

MD5
31b3afe4ccdb566559b226d6983be81d

SHA1
563dd5b26b711384385b6ffc5bed4c85fb6fa0b4

SHA256
ae305b1abe1be058cd1de62e2f969e35a11d2482c57e2946daa142d2ff0c77bb

SHA512
dcdbf62e6be6df6bed9679e3d14705949ef89f4166df2db45260d21a7a3d8d7dd46c1c910c48561078bf8a1d77094f6f7c63bcc0ec2915f7220c635aea588b62

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
38KB

MD5
31b3afe4ccdb566559b226d6983be81d

SHA1
563dd5b26b711384385b6ffc5bed4c85fb6fa0b4

SHA256
ae305b1abe1be058cd1de62e2f969e35a11d2482c57e2946daa142d2ff0c77bb

SHA512
dcdbf62e6be6df6bed9679e3d14705949ef89f4166df2db45260d21a7a3d8d7dd46c1c910c48561078bf8a1d77094f6f7c63bcc0ec2915f7220c635aea588b62

Download Submit
memory/1736-20-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/1736-19-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/1736-26-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/4124-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/4124-1-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/4124-2-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/4124-3-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/4124-18-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download