eaf8a00f14c40fd9e2669d190767ee85a1f63bd4ef971fb11f2d2c20057fa4b3

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 13:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-06-24_47ae739a8496591d63deec9a2ce429db_cryptolocker.exe
Size

58KB
MD5

47ae739a8496591d63deec9a2ce429db
SHA1

2144aba4d28cf410623b5640c5edce5d46ae8495
SHA256

eaf8a00f14c40fd9e2669d190767ee85a1f63bd4ef971fb11f2d2c20057fa4b3
SHA512

1d6420851d52fed9509a06e31664f1e61d8d7fcd27fe71ff8fa99b9695bd5320ebbc93ae645a1e39f3c7d34ba8dde682b8ce6ab4d35daf3f37c70887e18150df
SSDEEP

768:79inqyNR/QtOOtEvwDpjBK/iVTab3GRuv3VylsPQQWTa/2wT:79mqyNhQMOtEvwDpjBPY7xv3gy9WTAh

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	2024-06-24_47ae739a8496591d63deec9a2ce429db_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
752	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 752	540	2024-06-24_47ae739a8496591d63deec9a2ce429db_cryptolocker.exe	83
PID 540 wrote to memory of 752	540	2024-06-24_47ae739a8496591d63deec9a2ce429db_cryptolocker.exe	83
PID 540 wrote to memory of 752	540	2024-06-24_47ae739a8496591d63deec9a2ce429db_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-06-24_47ae739a8496591d63deec9a2ce429db_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-24_47ae739a8496591d63deec9a2ce429db_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:540
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
58KB

MD5
4f572691b5b0f36f6dc0425c65de9684

SHA1
2e11540388d954d46392d74c7d9a76dedca08527

SHA256
98f916037f7e43fc3ffb878cc2e51eedae7c99d88ac9ce7c72d889a614042481

SHA512
f62e9bca06c56936aa3e214ec0aaffaa24c76b91fc0147aebdb3719494ee7e5b4b3a80e8ac4ddfae1719db60e314aed1cbabf37bc05c40d64a61ef5074968e5d

Download Submit
memory/540-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/540-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/540-2-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/540-9-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/540-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/752-18-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/752-26-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/752-20-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download