Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/04/2024, 17:35

General

  • Target

    202404148eb46a8e460c55459c5af5f8933c2d5ecryptolocker.exe

  • Size

    100KB

  • MD5

    8eb46a8e460c55459c5af5f8933c2d5e

  • SHA1

    2addd9a3e8a0f33ce159bd46f9736772e8805e43

  • SHA256

    d51d45f5dd4e5288b88eadc399a0384ed35170b4aaefc74337a1769f49c2424f

  • SHA512

    9330f2180f56612aca4a2e64fdcbc04cbed059e2bb85d63c9509fcfd8553425c92d2d230b6aa2ef4f54f8619439a3b0f0a139facf13cdbbdedf43efd4c5b320b

  • SSDEEP

    1536:26QFElP6n+gBQMOtEvwDpjQGYQbN/PKwNCWwB:26a+2OtEvwDpjtzm

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\202404148eb46a8e460c55459c5af5f8933c2d5ecryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\202404148eb46a8e460c55459c5af5f8933c2d5ecryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4976
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:3320

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    100KB

    MD5

    bccbddea974f78a180b7af1192e270ab

    SHA1

    ada9f334c72e74ffd926ea1d5e8dc739a87f7402

    SHA256

    047093e1850d3042f8915c65e6da05fbc23cf071d7484eaee48ea3495d9584b8

    SHA512

    f6af5bbef5b65df46ff0b73529071a800b0d461833625c3b0a2cd1ba553be1759cbecf755b611c94f8aab47c7b207e67dd4eaeac584132afffe4effae5fe68b4

  • memory/3320-17-0x0000000001FF0000-0x0000000001FF6000-memory.dmp

    Filesize

    24KB

  • memory/3320-19-0x0000000001FD0000-0x0000000001FD6000-memory.dmp

    Filesize

    24KB

  • memory/4976-0-0x0000000000830000-0x0000000000836000-memory.dmp

    Filesize

    24KB

  • memory/4976-1-0x0000000000830000-0x0000000000836000-memory.dmp

    Filesize

    24KB

  • memory/4976-2-0x00000000020F0000-0x00000000020F6000-memory.dmp

    Filesize

    24KB