Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2024 15:41
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-10_14ef379fad7a73a1d03d3934c45abec3_cryptolocker.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-07-10_14ef379fad7a73a1d03d3934c45abec3_cryptolocker.exe
Resource
win10v2004-20240709-en
General
-
Target
2024-07-10_14ef379fad7a73a1d03d3934c45abec3_cryptolocker.exe
-
Size
46KB
-
MD5
14ef379fad7a73a1d03d3934c45abec3
-
SHA1
c346d49c678e4574d522500db0fffaf8857108c8
-
SHA256
03e486670ad9c242f09567e513760ea470cc6902ed17d763c6c971c826a0b0f1
-
SHA512
ad7498b961019b35985f8e6a5df8d0d0fbbe7332ec9fee3f906b49815ead58104875f1247b6da0958101f48143596a2a345884f327f10c8a5df1121c8b722987
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2MoLh:qmbhXDmjr5MOtEvwDpj5cDtKkQZQ7
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation 2024-07-10_14ef379fad7a73a1d03d3934c45abec3_cryptolocker.exe -
Executes dropped EXE 1 IoCs
pid Process 4144 asih.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1596 wrote to memory of 4144 1596 2024-07-10_14ef379fad7a73a1d03d3934c45abec3_cryptolocker.exe 86 PID 1596 wrote to memory of 4144 1596 2024-07-10_14ef379fad7a73a1d03d3934c45abec3_cryptolocker.exe 86 PID 1596 wrote to memory of 4144 1596 2024-07-10_14ef379fad7a73a1d03d3934c45abec3_cryptolocker.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-10_14ef379fad7a73a1d03d3934c45abec3_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-10_14ef379fad7a73a1d03d3934c45abec3_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:4144
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD516e51870a5fd8dcacef1ae103a356568
SHA1983fa4893684d004c60536ea0049390aef7892f7
SHA2560158721de9661b189296c36d5908dd8c44bc5ee6339c99216d128867dfac741e
SHA5121cd4d0a051654804c7f93a12743de11b56238072bb0d1218d401c8f242efea28d8e82db82acb3ceec4972b486c18f0aa5f5a9d672a363dd8b62a204959185df8