2407f65c0cd6c1ce6624d538cef1f572bc9749dce84250cc0cd3a4e9b392b561

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 03:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-20_77e18ff1bbd1f0c2d3324a63b96948ed_cryptolocker.exe
Size

48KB
MD5

77e18ff1bbd1f0c2d3324a63b96948ed
SHA1

94cb70d486a9f646cf956076d9ea6a313311a377
SHA256

2407f65c0cd6c1ce6624d538cef1f572bc9749dce84250cc0cd3a4e9b392b561
SHA512

5c05fa7f8b0f803578112e8b3fe3a751cece75bb825d0719c9f75d7b10b2ebc69a885146f7a9907a1c1b183b6713774ca1c80ed399faa2a91fa879f4103398b6
SSDEEP

768:79inqyNR/QtOOtEvwDpjBKccJVODvy3SpU3r:79mqyNhQMOtEvwDpjBzckqS2r

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	2024-06-20_77e18ff1bbd1f0c2d3324a63b96948ed_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
812	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 812	1080	2024-06-20_77e18ff1bbd1f0c2d3324a63b96948ed_cryptolocker.exe	83
PID 1080 wrote to memory of 812	1080	2024-06-20_77e18ff1bbd1f0c2d3324a63b96948ed_cryptolocker.exe	83
PID 1080 wrote to memory of 812	1080	2024-06-20_77e18ff1bbd1f0c2d3324a63b96948ed_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-06-20_77e18ff1bbd1f0c2d3324a63b96948ed_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-20_77e18ff1bbd1f0c2d3324a63b96948ed_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
48KB

MD5
685da9d552f5417dcfc6067a27729d88

SHA1
78826bd13dd941fdb3ce2fe568feda1c6b5bcca8

SHA256
815f648084bd4be6a9d99743b48b91a64bb4d55da2d96781c1f83b07211384dd

SHA512
c7a8ee9752db6804c0969e6fbf1847dcbac9cde72e22bd21632271c7df6400c5dd476fa6847bf2f2b0e9b661c8c3f1da86be41a4a1f52bde1370bd5dc8d7e0f4

Download Submit
memory/812-18-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/812-20-0x0000000002100000-0x0000000002106000-memory.dmp

Filesize
24KB

Download
memory/812-26-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/1080-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1080-1-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/1080-3-0x00000000007D0000-0x00000000007D6000-memory.dmp

Filesize
24KB

Download
memory/1080-2-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/1080-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download