Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-07-2024 15:41

General

  • Target

    2024-07-10_14ef379fad7a73a1d03d3934c45abec3_cryptolocker.exe

  • Size

    46KB

  • MD5

    14ef379fad7a73a1d03d3934c45abec3

  • SHA1

    c346d49c678e4574d522500db0fffaf8857108c8

  • SHA256

    03e486670ad9c242f09567e513760ea470cc6902ed17d763c6c971c826a0b0f1

  • SHA512

    ad7498b961019b35985f8e6a5df8d0d0fbbe7332ec9fee3f906b49815ead58104875f1247b6da0958101f48143596a2a345884f327f10c8a5df1121c8b722987

  • SSDEEP

    768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2MoLh:qmbhXDmjr5MOtEvwDpj5cDtKkQZQ7

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-07-10_14ef379fad7a73a1d03d3934c45abec3_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-07-10_14ef379fad7a73a1d03d3934c45abec3_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1596
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:4144

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    46KB

    MD5

    16e51870a5fd8dcacef1ae103a356568

    SHA1

    983fa4893684d004c60536ea0049390aef7892f7

    SHA256

    0158721de9661b189296c36d5908dd8c44bc5ee6339c99216d128867dfac741e

    SHA512

    1cd4d0a051654804c7f93a12743de11b56238072bb0d1218d401c8f242efea28d8e82db82acb3ceec4972b486c18f0aa5f5a9d672a363dd8b62a204959185df8

  • memory/1596-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/1596-1-0x0000000000660000-0x0000000000666000-memory.dmp

    Filesize

    24KB

  • memory/1596-2-0x0000000000660000-0x0000000000666000-memory.dmp

    Filesize

    24KB

  • memory/1596-3-0x0000000000810000-0x0000000000816000-memory.dmp

    Filesize

    24KB

  • memory/1596-18-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/4144-17-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/4144-21-0x0000000002000000-0x0000000002006000-memory.dmp

    Filesize

    24KB

  • memory/4144-20-0x00000000004E0000-0x00000000004E6000-memory.dmp

    Filesize

    24KB

  • memory/4144-27-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB