656bed6542e23fca9d40dc8f7d7c04e6128ed3cc8a0eea2579f931f31d8c1737

Analysis

max time kernel
144s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2024 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-06_583320ee13f1d2d1443ae48dec01196e_cryptolocker.exe
Size

33KB
MD5

583320ee13f1d2d1443ae48dec01196e
SHA1

596fb1294b06ad6b3fcf54e69b7674122df30969
SHA256

656bed6542e23fca9d40dc8f7d7c04e6128ed3cc8a0eea2579f931f31d8c1737
SHA512

4dc538a5c3ae968cd7ee4fe138cdbd12e883dd61d01677ff8e2f589d1b4b55dd42844b76cfd63cbbfdc15ae8cee1bec9323a8814de4fa0ef56665f3723ffd7a6
SSDEEP

768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmod:qmbhXDmjr5MOtEvwDpj5cDd

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	2024-01-06_583320ee13f1d2d1443ae48dec01196e_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
316	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 316	3780	2024-01-06_583320ee13f1d2d1443ae48dec01196e_cryptolocker.exe	19
PID 3780 wrote to memory of 316	3780	2024-01-06_583320ee13f1d2d1443ae48dec01196e_cryptolocker.exe	19
PID 3780 wrote to memory of 316	3780	2024-01-06_583320ee13f1d2d1443ae48dec01196e_cryptolocker.exe	19

C:\Users\Admin\AppData\Local\Temp\2024-01-06_583320ee13f1d2d1443ae48dec01196e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-06_583320ee13f1d2d1443ae48dec01196e_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
33KB

MD5
506142860ee282e803346da238c75229

SHA1
f1b296e4f84acf704eae3cb88c56ae1ef1f83e6e

SHA256
017ea5a1b9c61c3bfa754f26791f9458d2cbcaa5032e92f7608186c8992b2308

SHA512
3543d68ed651bf2b6eb2dd4da5eb1bcd6449906acf82a058970f75c8e4e213ce42d83c39a2c13bd3f0b8ab2f04d7b6a413a741753ad3e47104f92dab1b45f547

Download Submit
memory/316-26-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/316-20-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/316-18-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/316-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3780-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3780-2-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/3780-3-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/3780-1-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/3780-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download