62f98720609ceea9e16ac9f77ac668289affe8cdc24debb220404a0a14d73f98

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-23_ad55fb40fc293fd3dc7412927c6b6f08_cryptolocker.exe
Size

55KB
MD5

ad55fb40fc293fd3dc7412927c6b6f08
SHA1

6ac709ff68c9513196c8f0d39ebd2314159f75a1
SHA256

62f98720609ceea9e16ac9f77ac668289affe8cdc24debb220404a0a14d73f98
SHA512

3352d1da2f05eb8af6b43f6385a01bfd672c80f5364c5f6a5ecbd2322c6249900fa3d2ba05724bdfcd563dc436774dad11ddc88eb092a6f00e9545627594a63c
SSDEEP

768:79inqyNR/QtOOtEvwDpjBK/rJ+Nw8qn8pKIRszDr6KAtv:79mqyNhQMOtEvwDpjBxe8TpXRSDeKm

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	2024-07-23_ad55fb40fc293fd3dc7412927c6b6f08_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3680	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-07-23_ad55fb40fc293fd3dc7412927c6b6f08_cryptolocker.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 3680	2512	2024-07-23_ad55fb40fc293fd3dc7412927c6b6f08_cryptolocker.exe	87
PID 2512 wrote to memory of 3680	2512	2024-07-23_ad55fb40fc293fd3dc7412927c6b6f08_cryptolocker.exe	87
PID 2512 wrote to memory of 3680	2512	2024-07-23_ad55fb40fc293fd3dc7412927c6b6f08_cryptolocker.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-07-23_ad55fb40fc293fd3dc7412927c6b6f08_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-23_ad55fb40fc293fd3dc7412927c6b6f08_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
55KB

MD5
dd681265c2d82618439b2759b40f2704

SHA1
9560d9a406993aed8f82e16f649133e7d77a7dac

SHA256
4f8e14403aa838e8f014aeaa8a21e4f9bf3320126530a938ccaf920f2edd79a2

SHA512
2a0afdbe137d93611dbd43adb62a902ae402bc6c99dfaf5f8014ea881ce5105d4c602df80ae43638fe2b2cc41116fa8d64f5e74fbda6a1480f96f3a3cc239b1c

Download Submit
memory/2512-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2512-1-0x00000000007F0000-0x00000000007F6000-memory.dmp

Filesize
24KB

Download
memory/2512-2-0x00000000007F0000-0x00000000007F6000-memory.dmp

Filesize
24KB

Download
memory/2512-3-0x0000000000810000-0x0000000000816000-memory.dmp

Filesize
24KB

Download
memory/2512-18-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3680-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3680-20-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/3680-26-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download