d3cfd8fb0b36d983f157ddbc935886288b1257372a5da97f16bf658d013187a7

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2024 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-25_8bd5f712466992672e58f466330a67ae_cryptolocker.exe
Size

55KB
MD5

8bd5f712466992672e58f466330a67ae
SHA1

3f0eae7e00588bff2955bf1dbc14bfd16ed9177f
SHA256

d3cfd8fb0b36d983f157ddbc935886288b1257372a5da97f16bf658d013187a7
SHA512

c6279803dd3cf5c70d871e0c284a6850ba567b46ec403a4f874aa2ae2ccd4414da458b47b6d49ed4dee9c7cdbf4085f2dd4344600b37d1ae6ee91dab8dde4a37
SSDEEP

768:79inqyNR/QtOOtEvwDpjBK/rJ+Nw8qn8pKIRszDr6KAti:79mqyNhQMOtEvwDpjBxe8TpXRSDeKD

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	2024-08-25_8bd5f712466992672e58f466330a67ae_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3480	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-25_8bd5f712466992672e58f466330a67ae_cryptolocker.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 3480	4560	2024-08-25_8bd5f712466992672e58f466330a67ae_cryptolocker.exe	84
PID 4560 wrote to memory of 3480	4560	2024-08-25_8bd5f712466992672e58f466330a67ae_cryptolocker.exe	84
PID 4560 wrote to memory of 3480	4560	2024-08-25_8bd5f712466992672e58f466330a67ae_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-08-25_8bd5f712466992672e58f466330a67ae_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-25_8bd5f712466992672e58f466330a67ae_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
55KB

MD5
6d0984e4a7b58f8a0234c8f3194a5efb

SHA1
3cc7f71587b0ab2bb479810face4e5a7adba4ad7

SHA256
cd1f0c2beda563449c6762272f618b5ed0e970f2c307da1cf67579b8ab1d3eb9

SHA512
c76436c406b1e1c36f0e9a57f38cb927e127b286474ee7ede6229f8de3a997ee5cf2096c89c20c57326019f7226cd45863a946c2506bb63c54671e8f62b1e086

Download Submit
memory/3480-19-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/3480-25-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/3480-26-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4560-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4560-1-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/4560-2-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/4560-3-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/4560-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download