5d2685aad54e089c312ae31c0cc4eec0f5f6da77c5f8b2e236a2a7bc90f99cf5

Analysis

max time kernel
2s
max time network
85s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2024 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-08_c5dae3e2c76f56060f6d640ae2f8120d_cryptolocker.exe
Size

43KB
MD5

c5dae3e2c76f56060f6d640ae2f8120d
SHA1

04b90d8f9902991d3d18a03c5580ea69e65ce6ce
SHA256

5d2685aad54e089c312ae31c0cc4eec0f5f6da77c5f8b2e236a2a7bc90f99cf5
SHA512

646c450cc108337e4c0661a536fa6718898dc9d752e8651c6287652658c13abc7c171de9560e2130f1c9b19555ed1193573eda29d6f6a5eed7af59df3177c056
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaaEqbIu55N:X6QFElP6n+gJQMOtEvwDpjB0GIWN

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	2024-01-08_c5dae3e2c76f56060f6d640ae2f8120d_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\2024-01-08_c5dae3e2c76f56060f6d640ae2f8120d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-08_c5dae3e2c76f56060f6d640ae2f8120d_cryptolocker.exe"
1⤵
- Checks computer location settings
PID:2348
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
1KB

MD5
8e51d16953e4694da7d5bb19ed880d84

SHA1
348adc5291a275c87198ba80f929f3d1528036c2

SHA256
64671f22ae537f8af697dac99f8c892b1e698d7beec13b972980bd71e0d8a1e0

SHA512
97b37c6419953ff2183365e4f994b6d7664bbc71e57373ccd1347b2355de7dfca810d6e0b3826eb7d787fbea08f0b393388afb21f498f8d26b30862f09136d1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
3KB

MD5
4f8c0a5a4302635978cbf80320d8706e

SHA1
8bc4ccf5aaedcef0968ff327e06f04f6c8e36fab

SHA256
8d142139818d542ad911b7853b0f65dc7010edd1010812557a5ff11016b0d740

SHA512
0c74a255003d601601060e0e6bc38e36ffc57c0bb830ecca5312ae603e1b004d4f0588bb581ab6ed537a3b81c0d4370d46eb05e8b0e2b9ab8f565d9924ae0bd4

Download Submit
memory/2348-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2348-2-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/2348-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2548-23-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/2548-17-0x0000000000750000-0x0000000000756000-memory.dmp

Filesize
24KB

Download