a594458be002964faeb265cd983649da127b795e92d0bf1f2ce359693f2ed291

Analysis

max time kernel
143s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20240615a1af3f97d301f9f381cd9ac1d9861f21cryptolocker.exe
Size

47KB
MD5

a1af3f97d301f9f381cd9ac1d9861f21
SHA1

d5ae9101fcf1d767984539ff0014f0341b88a4b1
SHA256

a594458be002964faeb265cd983649da127b795e92d0bf1f2ce359693f2ed291
SHA512

76b81eed9239eceb75f52082753ab0b6e5eb6d6978639de231e50bbf535a3660a5f7f8ed7b48f7fae5606c27ecc221872067c444251f0800ace151aa8290f953
SSDEEP

384:e/4wODQkzonAYsju5N/surDQtOOtEvwDpjqIGROqS/WccJVJwi2B5oCCM8CLW2Vp:79inqyNR/QtOOtEvwDpjBKccJVODvy3Y

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	20240615a1af3f97d301f9f381cd9ac1d9861f21cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
564	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 564	4416	20240615a1af3f97d301f9f381cd9ac1d9861f21cryptolocker.exe	91
PID 4416 wrote to memory of 564	4416	20240615a1af3f97d301f9f381cd9ac1d9861f21cryptolocker.exe	91
PID 4416 wrote to memory of 564	4416	20240615a1af3f97d301f9f381cd9ac1d9861f21cryptolocker.exe	91

C:\Users\Admin\AppData\Local\Temp\20240615a1af3f97d301f9f381cd9ac1d9861f21cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\20240615a1af3f97d301f9f381cd9ac1d9861f21cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
47KB

MD5
a3cebacd627ecf8ff10eff90befffc8c

SHA1
a0d6148a7876acf64f5a4f0cc73ac4b3ce1e8824

SHA256
ee175a83ea2bebff4da5d5bc5da60c0e95142a614f36ba997f608b74de578b80

SHA512
37990b5bfa719af0005025b0b59783529bb53ab49b5c692adb99cf774a996cf097af59bea51418870198acdb82f2c7e1947710534fc91660989a8bda0c4e7202

Download Submit
memory/564-18-0x0000000001F70000-0x0000000001F76000-memory.dmp

Filesize
24KB

Download
memory/564-24-0x0000000001F50000-0x0000000001F56000-memory.dmp

Filesize
24KB

Download
memory/4416-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4416-1-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/4416-2-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/4416-3-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/4416-25-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download