08ea3cf831a7a1f88b1db7b7a4af105975aa3d394db4dcce427ccbad3d984617

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 11:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-20_838ec65b1ce386f580c74b8589a78ac8_cryptolocker.exe
Size

48KB
MD5

838ec65b1ce386f580c74b8589a78ac8
SHA1

a3bba44cfe35c1082c1b71a18d495706a5406a28
SHA256

08ea3cf831a7a1f88b1db7b7a4af105975aa3d394db4dcce427ccbad3d984617
SHA512

31f180a7741f66a1934fdf3b15c837225388f445e0566be4a0150625a7916b2e541df994a4990d6044fb1c4ec54fbc00554cca420445bbf5fcea67026a863181
SSDEEP

768:79inqyNR/QtOOtEvwDpjBKccJVODvy3SpU3f:79mqyNhQMOtEvwDpjBzckqS2f

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	2024-06-20_838ec65b1ce386f580c74b8589a78ac8_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
904	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 904	1436	2024-06-20_838ec65b1ce386f580c74b8589a78ac8_cryptolocker.exe	84
PID 1436 wrote to memory of 904	1436	2024-06-20_838ec65b1ce386f580c74b8589a78ac8_cryptolocker.exe	84
PID 1436 wrote to memory of 904	1436	2024-06-20_838ec65b1ce386f580c74b8589a78ac8_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-06-20_838ec65b1ce386f580c74b8589a78ac8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-20_838ec65b1ce386f580c74b8589a78ac8_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
48KB

MD5
14bf5556adf2ca52b2994f8bc6553e9a

SHA1
93d4fcb4f38a2afd0d55637a04ea0b433b4ffdd4

SHA256
d8da527fa8d1555c6a619076207c806e13ae2eaa5a7184d7bfac5cd2daf63cac

SHA512
c16c7413190c9355e0be5b35204d5a215ebaeb60aab0c88aff212fa71cfefb02af1adcfd937a5c36ee65fdf2b9755c9c164a7a9f0610ce15559489a10f4e601f

Download Submit
memory/904-19-0x00000000007D0000-0x00000000007D6000-memory.dmp

Filesize
24KB

Download
memory/904-25-0x00000000007B0000-0x00000000007B6000-memory.dmp

Filesize
24KB

Download
memory/1436-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1436-1-0x0000000000740000-0x0000000000746000-memory.dmp

Filesize
24KB

Download
memory/1436-2-0x0000000000760000-0x0000000000766000-memory.dmp

Filesize
24KB

Download
memory/1436-9-0x0000000000740000-0x0000000000746000-memory.dmp

Filesize
24KB

Download
memory/1436-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download