1aa5ac5f7cc898b6f0714d38e52e87fcccc5010382991574d9b2201bb2292633

Analysis

max time kernel
139s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-08_7b14c7984b6adc267b2ad010e0514f9e_cryptolocker.exe
Size

75KB
MD5

7b14c7984b6adc267b2ad010e0514f9e
SHA1

68923e0ac09230876cbd21feb833d368307477a0
SHA256

1aa5ac5f7cc898b6f0714d38e52e87fcccc5010382991574d9b2201bb2292633
SHA512

33129dc5391c745e14163cde35bb87fbf95c256cc76c7b0b8e735869ed03e17bb6bb3abb10f167c7819c167b18611dfd8dab4346b23e9527b52eabbc7e5c60aa
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1bB/rIm:X6a+SOtEvwDpjBZYvQd2j

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	2024-01-08_7b14c7984b6adc267b2ad010e0514f9e_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3620	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 3620	4572	2024-01-08_7b14c7984b6adc267b2ad010e0514f9e_cryptolocker.exe	82
PID 4572 wrote to memory of 3620	4572	2024-01-08_7b14c7984b6adc267b2ad010e0514f9e_cryptolocker.exe	82
PID 4572 wrote to memory of 3620	4572	2024-01-08_7b14c7984b6adc267b2ad010e0514f9e_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-01-08_7b14c7984b6adc267b2ad010e0514f9e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-08_7b14c7984b6adc267b2ad010e0514f9e_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
75KB

MD5
73a58d5a3231e56c23604329a35514e1

SHA1
2319bbe6338bbd75306ca155307def6330d4e2dc

SHA256
da70ae638476912108c3f2f6c6c0ea559ce5b01b149a4f7677c61b6f9333d5fc

SHA512
ee3f56cfd73018022ae7399249608d161c57bb43203d538f12cfa7a76f61d63528c5692c3e7d107adfd20f141b0f19a4ba2b9339006316bc9663f0ad912a377b

Download Submit
memory/4572-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4572-2-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/4572-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download