c25d9b3623783cf4ec45e6616c9784d3191150a4ef34e3c7e6961f8fdf605e40

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 22:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-26_e55716284a21c7e7263b64f81b69ad94_cryptolocker.exe
Size

44KB
MD5

e55716284a21c7e7263b64f81b69ad94
SHA1

1940688e0a37f7ef64493423f281c171edabd465
SHA256

c25d9b3623783cf4ec45e6616c9784d3191150a4ef34e3c7e6961f8fdf605e40
SHA512

d7375e5a677917d7c484adb3e1a456f7b7b6acab564b19881bf02ae501b84c1769de9d7b5384292c306247cff7e628f1159f3de1cd95ebb54599a35150288872
SSDEEP

768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkL7vF1TF:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkLF

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation	2024-07-26_e55716284a21c7e7263b64f81b69ad94_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4132	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-07-26_e55716284a21c7e7263b64f81b69ad94_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 4132	1140	2024-07-26_e55716284a21c7e7263b64f81b69ad94_cryptolocker.exe	84
PID 1140 wrote to memory of 4132	1140	2024-07-26_e55716284a21c7e7263b64f81b69ad94_cryptolocker.exe	84
PID 1140 wrote to memory of 4132	1140	2024-07-26_e55716284a21c7e7263b64f81b69ad94_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-07-26_e55716284a21c7e7263b64f81b69ad94_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-26_e55716284a21c7e7263b64f81b69ad94_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
44KB

MD5
2836dd1d7b5a1b20c54bf6a38e31b15e

SHA1
f9ce898a85127e4669df94f9c49c4a502fe49acb

SHA256
c1ba8aa09e11739dafeb97075f822780ca5ebb0ab18f8cc4f4c6a920b0addfbc

SHA512
69d73310ab22f08f8d1f8bb0cd92a02774b4b3ce14e9b20822500bdd271363a1a3eddecef6df5b9b7f827da476a0e13fc5db883661e5ba83bd8980d8ac144f2d

Download Submit
memory/1140-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1140-1-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/1140-2-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/1140-3-0x0000000002080000-0x0000000002086000-memory.dmp

Filesize
24KB

Download
memory/1140-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/4132-19-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/4132-25-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download