05ef4ca3336ea5721a745ab2c0c88b2f2bb4b160de21dda3481d2419204a8db3

Analysis

max time kernel
1s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-09_5f92f531d14c840738a94684268f8e9a_cryptolocker.exe
Size

65KB
MD5

5f92f531d14c840738a94684268f8e9a
SHA1

4182499cb9714096a5b996e4401a2f51860d0212
SHA256

05ef4ca3336ea5721a745ab2c0c88b2f2bb4b160de21dda3481d2419204a8db3
SHA512

38144eef1a06b6d8f226add12b53568e25f43c6808c8e2ca18c2ba123f0a9a37f6830bd046e53ff4459907a121393e33676e85e96fed03a0ef7882a33801dda3
SSDEEP

1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKu:DW60sllyWOtEvwDpjwF85P

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	2024-01-09_5f92f531d14c840738a94684268f8e9a_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4760	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 4760	4324	2024-01-09_5f92f531d14c840738a94684268f8e9a_cryptolocker.exe	28
PID 4324 wrote to memory of 4760	4324	2024-01-09_5f92f531d14c840738a94684268f8e9a_cryptolocker.exe	28
PID 4324 wrote to memory of 4760	4324	2024-01-09_5f92f531d14c840738a94684268f8e9a_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-09_5f92f531d14c840738a94684268f8e9a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-09_5f92f531d14c840738a94684268f8e9a_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
65KB

MD5
56ae096e63b7158d795d9709bbbe8148

SHA1
0c5267d4fdc08395a88be8e753837b55105e3863

SHA256
91485be2cb5668233c7051bc5f7c93c8753553e638710e76cf996c386edb41b3

SHA512
c2917fdff22c2a727984111e0c43ab44bba25fb08d713c6ed41520d7389fe5bb0aed8468ca86e7f2dcc9fdeb00033921f346b98eaa48236d533623f1145d0964

Download Submit
memory/4324-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/4324-1-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/4324-2-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/4324-3-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/4324-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/4760-19-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/4760-25-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download