f2eda6a687fce183d2f99ca621432999731a2aab475b9c538b413a3f1a2730a4

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 08:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-27_18c99e0bc12302df7d958682891ad22a_cryptolocker.exe
Size

55KB
MD5

18c99e0bc12302df7d958682891ad22a
SHA1

c8dbf398bcffb088981a2ded3838bade772a4049
SHA256

f2eda6a687fce183d2f99ca621432999731a2aab475b9c538b413a3f1a2730a4
SHA512

608c1cb46eecfd693b9f57db383164162e23c65461035c333227d2976b506d4a44c74407c114ea6075fddbda996e6ab42087fd11ad20ba9fc7c7f1d0539dcd4e
SSDEEP

768:79inqyNR/QtOOtEvwDpjBK/rJ+Nw8qn8pKIRszDr6KAtEZ:79mqyNhQMOtEvwDpjBxe8TpXRSDeKTZ

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	2024-07-27_18c99e0bc12302df7d958682891ad22a_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1240	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-07-27_18c99e0bc12302df7d958682891ad22a_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 1240	2316	2024-07-27_18c99e0bc12302df7d958682891ad22a_cryptolocker.exe	84
PID 2316 wrote to memory of 1240	2316	2024-07-27_18c99e0bc12302df7d958682891ad22a_cryptolocker.exe	84
PID 2316 wrote to memory of 1240	2316	2024-07-27_18c99e0bc12302df7d958682891ad22a_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-07-27_18c99e0bc12302df7d958682891ad22a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-27_18c99e0bc12302df7d958682891ad22a_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
55KB

MD5
d01a79164af5fcb6f5967abdebf55991

SHA1
e518b6be584569175799d211d2e97d51d40b373f

SHA256
224e9ab376e6260c62f7479076e818aaec69b2b060fc2e96e1232b44621da5ce

SHA512
3e10cbd0a0d98704bffbe1eb514625826df9cfafab3568ab669c5f0ff04eb0d389b87465747e57e59761ae66d6ea0f8521c37ac5f5f627e529bedde439753aa2

Download Submit
memory/1240-19-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/1240-25-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/2316-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2316-1-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/2316-2-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/2316-3-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/2316-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download