ff86dcf5bc96c2c02bc92892f6026aeeeb5b167da778b1e86104046e2b61e549

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2024 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-11_8a1b1e82834662e1d919c623a52ef163_cryptolocker.exe
Size

48KB
MD5

8a1b1e82834662e1d919c623a52ef163
SHA1

e743caf390cfc416bf4fd202b92af70fc66e23cb
SHA256

ff86dcf5bc96c2c02bc92892f6026aeeeb5b167da778b1e86104046e2b61e549
SHA512

b1c5a84e74a71b51193ecb1299aa9c7a242a7202ac704b64fc8069f2d0566e886815da02e55af91af43624b3dc5072eca0458503fc2103fc8f5bcd70e671a156
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09viE:X6QFElP6n+gJBMOtEvwDpjBtE9

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	2024-01-11_8a1b1e82834662e1d919c623a52ef163_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2396	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 2396	4316	2024-01-11_8a1b1e82834662e1d919c623a52ef163_cryptolocker.exe	27
PID 4316 wrote to memory of 2396	4316	2024-01-11_8a1b1e82834662e1d919c623a52ef163_cryptolocker.exe	27
PID 4316 wrote to memory of 2396	4316	2024-01-11_8a1b1e82834662e1d919c623a52ef163_cryptolocker.exe	27

C:\Users\Admin\AppData\Local\Temp\2024-01-11_8a1b1e82834662e1d919c623a52ef163_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-11_8a1b1e82834662e1d919c623a52ef163_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
1KB

MD5
8e51d16953e4694da7d5bb19ed880d84

SHA1
348adc5291a275c87198ba80f929f3d1528036c2

SHA256
64671f22ae537f8af697dac99f8c892b1e698d7beec13b972980bd71e0d8a1e0

SHA512
97b37c6419953ff2183365e4f994b6d7664bbc71e57373ccd1347b2355de7dfca810d6e0b3826eb7d787fbea08f0b393388afb21f498f8d26b30862f09136d1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
7KB

MD5
739842dfabd0c26fc99826f69783c81f

SHA1
619622683fd2d07c3f18ad00cc90ab5252592379

SHA256
49a4545d93594765b2476ea9c82278a8d4ca20cc7140ab3efc05e8841298d477

SHA512
93589d0e8f7c705f034f294094e68539ce33cbf2adaf2a83e75aa753d6993b9bd1afa43ae2ae1904f41f8bee7c68879403808904ffab35b04dcd1adfd67cc204

Download Submit
memory/2396-23-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/2396-17-0x0000000000690000-0x0000000000696000-memory.dmp

Filesize
24KB

Download
memory/4316-2-0x0000000000750000-0x0000000000756000-memory.dmp

Filesize
24KB

Download
memory/4316-1-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/4316-0-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download