b7f5f1ee3b5f5f0ae5fd7cd4861b2f71dc9c30ab7cfe4bb46e54f07dc5c20afe

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 12:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-06_142748cd4f31656b0947afd404b67b59_cryptolocker.exe
Size

49KB
MD5

142748cd4f31656b0947afd404b67b59
SHA1

6953cd6cf0aa1ece915febcfaf60c72aaa6a04d6
SHA256

b7f5f1ee3b5f5f0ae5fd7cd4861b2f71dc9c30ab7cfe4bb46e54f07dc5c20afe
SHA512

07abc5638ae5070a30a24a05976be38f824bcd6c41513b5fa4a06b645c283858b3cc1dba20f65160515fefc322bc5eed7f5528165c0e7303b70c3082535234aa
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vaTiSfQag:X6QFElP6n+gJBMOtEvwDpjBtE1yg

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	2024-01-06_142748cd4f31656b0947afd404b67b59_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3612	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 3612	5028	2024-01-06_142748cd4f31656b0947afd404b67b59_cryptolocker.exe	19
PID 5028 wrote to memory of 3612	5028	2024-01-06_142748cd4f31656b0947afd404b67b59_cryptolocker.exe	19
PID 5028 wrote to memory of 3612	5028	2024-01-06_142748cd4f31656b0947afd404b67b59_cryptolocker.exe	19

C:\Users\Admin\AppData\Local\Temp\2024-01-06_142748cd4f31656b0947afd404b67b59_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-06_142748cd4f31656b0947afd404b67b59_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
49KB

MD5
8051d841f787a566139952111698aeaa

SHA1
5357a2d09e79c94e90d20b8e57f0f5838d631d23

SHA256
ae4d8497ddb320d6420e6130f6a3675e8b974e66b0ea9310b18c21ca595345ea

SHA512
071ca20f3244871612e245dfa1e8049b86e7683f1d43569b80552e2607c5a55914da3c2d3fc9c26841c9b5c153164e2f2beb475aae8fa8754294e9a49affa772

Download Submit
memory/3612-23-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/3612-17-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/5028-2-0x0000000000710000-0x0000000000716000-memory.dmp

Filesize
24KB

Download
memory/5028-1-0x00000000006F0000-0x00000000006F6000-memory.dmp

Filesize
24KB

Download
memory/5028-0-0x00000000006F0000-0x00000000006F6000-memory.dmp

Filesize
24KB

Download