d892167569d186a905775f14b17228af068b26b25346fa918d149337989def43

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 03:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-04_78f06b40d3290f11f9573c91ade43caa_cryptolocker.exe
Size

72KB
MD5

78f06b40d3290f11f9573c91ade43caa
SHA1

27cbcdd1b940b0f3ee31bcbe0fad22d7a8143133
SHA256

d892167569d186a905775f14b17228af068b26b25346fa918d149337989def43
SHA512

1031a615d3ad4cf9ba28851f3bfaf4a2f28bc0c9c5a347a08eb4c394d648e72a2c21457908646eac0944275efc10d4eedfe41c6df5c14959f8a4c6fbf1920fbe
SSDEEP

1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKUNZOQ:DW60sllyWOtEvwDpjwF85/

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	2024-07-04_78f06b40d3290f11f9573c91ade43caa_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2360	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 2360	1772	2024-07-04_78f06b40d3290f11f9573c91ade43caa_cryptolocker.exe	82
PID 1772 wrote to memory of 2360	1772	2024-07-04_78f06b40d3290f11f9573c91ade43caa_cryptolocker.exe	82
PID 1772 wrote to memory of 2360	1772	2024-07-04_78f06b40d3290f11f9573c91ade43caa_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-07-04_78f06b40d3290f11f9573c91ade43caa_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-04_78f06b40d3290f11f9573c91ade43caa_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
72KB

MD5
1de8347455c2eccd5fc7382072727bfb

SHA1
ad402469edead40216404dd33423cecaba9ee037

SHA256
5c36113491f6cee7c86aa60ebcfb52b1535c66460580293ea23742622eac2ee3

SHA512
da240358f7388b55562053d9d7b31059a4775b613692456adfc1f1f573207817a68ce5bb6353d98d2642e2ae5a5f37d964754ebc0a2fdcb6e5de90a6bb90cc2b

Download Submit
memory/1772-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1772-1-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/1772-2-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/1772-9-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/1772-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2360-19-0x0000000001F40000-0x0000000001F46000-memory.dmp

Filesize
24KB

Download
memory/2360-25-0x0000000000580000-0x0000000000586000-memory.dmp

Filesize
24KB

Download