8dafad418916bd6f77b0773659e12a547a121cd09cf694713fd2b2a02b25fed0

Analysis

max time kernel
185s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 05:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-10_bf95360763cfd8d59de8ec4ee22f4428_cryptolocker.exe
Size

92KB
MD5

bf95360763cfd8d59de8ec4ee22f4428
SHA1

e1cfa08b96e3eea082b090926419976f9f718f0b
SHA256

8dafad418916bd6f77b0773659e12a547a121cd09cf694713fd2b2a02b25fed0
SHA512

33388af1d5e4cce787dd22ee50341106bebd9dfcffec6b73d4c0d5f55898eaff21f39645720bcbd6c3b4b93485187d5878d05a346531e7a464f52745fe4a1ac3
SSDEEP

1536:26QFElP6n+gBQMOtEvwDpjQGYQbN/PKwNCf:26a+2OtEvwDpjtzk

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	2024-01-10_bf95360763cfd8d59de8ec4ee22f4428_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3636	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 3636	1620	2024-01-10_bf95360763cfd8d59de8ec4ee22f4428_cryptolocker.exe	92
PID 1620 wrote to memory of 3636	1620	2024-01-10_bf95360763cfd8d59de8ec4ee22f4428_cryptolocker.exe	92
PID 1620 wrote to memory of 3636	1620	2024-01-10_bf95360763cfd8d59de8ec4ee22f4428_cryptolocker.exe	92

C:\Users\Admin\AppData\Local\Temp\2024-01-10_bf95360763cfd8d59de8ec4ee22f4428_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-10_bf95360763cfd8d59de8ec4ee22f4428_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
92KB

MD5
2de1c205ca3e89e2460b73f00ca272f9

SHA1
fdf9dec5dd2f8490607cf7c82fcc75d5d3d5fb61

SHA256
4a6e2b20b2a2a2907a1444b291194205d697c66ee9ccceb3a1fdb203e602dffd

SHA512
5453820d0c5c2f1d1396ea301712e41abf07cc10d87c7d5b386f818c6eb0611b831d5818f798df5de24c293cdbc7246d1f7acf6a6571c61364874e29f2f63d69

Download Submit
memory/1620-0-0x0000000000670000-0x0000000000676000-memory.dmp

Filesize
24KB

Download
memory/1620-1-0x0000000000670000-0x0000000000676000-memory.dmp

Filesize
24KB

Download
memory/1620-2-0x0000000002080000-0x0000000002086000-memory.dmp

Filesize
24KB

Download
memory/3636-17-0x0000000000820000-0x0000000000826000-memory.dmp

Filesize
24KB

Download
memory/3636-18-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download