4241198b4fc5d522eb8f3efeb9dd189733720761635dabc3de92d74d33906521

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-09_ce6db0815ac7d768a3c6ff40e9f0ccba_cryptolocker.exe
Size

45KB
MD5

ce6db0815ac7d768a3c6ff40e9f0ccba
SHA1

cb404584f6b6601fb73e26131ee0e9d13b65e5cb
SHA256

4241198b4fc5d522eb8f3efeb9dd189733720761635dabc3de92d74d33906521
SHA512

94718c3087a20874225dbf46b5a7c2c65cb322f68cad87d97c48d2f0a5c6ef6a7319720f9899a489e32dcd7a6ad01336938e2696a639f250e524ba85c4ae2160
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaaEqbIu55Sw:X6QFElP6n+gJQMOtEvwDpjB0GIWSw

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	2024-01-09_ce6db0815ac7d768a3c6ff40e9f0ccba_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3636	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 3636	2480	2024-01-09_ce6db0815ac7d768a3c6ff40e9f0ccba_cryptolocker.exe	16
PID 2480 wrote to memory of 3636	2480	2024-01-09_ce6db0815ac7d768a3c6ff40e9f0ccba_cryptolocker.exe	16
PID 2480 wrote to memory of 3636	2480	2024-01-09_ce6db0815ac7d768a3c6ff40e9f0ccba_cryptolocker.exe	16

C:\Users\Admin\AppData\Local\Temp\2024-01-09_ce6db0815ac7d768a3c6ff40e9f0ccba_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-09_ce6db0815ac7d768a3c6ff40e9f0ccba_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
45KB

MD5
765a4b93ef3fd0947d9838c981c66e9d

SHA1
d66d85bea281b75e9157e9add3194fe2f93f4cd6

SHA256
86a2c4e840daac60a50e8710e8692e18bb897eb5a5935dbe3ec899fa812d7503

SHA512
08eb0d2f0d1f9f225538774635c60878873fd7537f38a89ce9b94f63d8acdde7dc51c4f476b2aca80ef8f2a104dfa42eb6aca93ce8688d7fc44e242c4b3de6d5

Download Submit
memory/2480-2-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/2480-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2480-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download