715142a4ee439507dd25b8c888e9f05cacd2d9a70f0867bf314289db68399dfd

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-29_589c070af90f36ba0e36678afaf44774_cryptolocker.exe
Size

36KB
MD5

589c070af90f36ba0e36678afaf44774
SHA1

9da7f11a1b6e8bfe1c81d66ec7a80259c1008011
SHA256

715142a4ee439507dd25b8c888e9f05cacd2d9a70f0867bf314289db68399dfd
SHA512

1274986aef0890a88deb161fb99a67a45015298479357cf02831473beb3dc111095ba56a897cc0925985eab90bf29e73bbc2a11be454708e7c0b1294671c920e
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBVaD3M:X6QFElP6n+gJQMOtEvwDpjB1

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	2024-08-29_589c070af90f36ba0e36678afaf44774_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4740	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-29_589c070af90f36ba0e36678afaf44774_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 4740	5104	2024-08-29_589c070af90f36ba0e36678afaf44774_cryptolocker.exe	84
PID 5104 wrote to memory of 4740	5104	2024-08-29_589c070af90f36ba0e36678afaf44774_cryptolocker.exe	84
PID 5104 wrote to memory of 4740	5104	2024-08-29_589c070af90f36ba0e36678afaf44774_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-08-29_589c070af90f36ba0e36678afaf44774_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-29_589c070af90f36ba0e36678afaf44774_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
36KB

MD5
56e61fc5f0ded47c81cb6a30e82643e3

SHA1
ac81f0f4cc86e7f2efe5a20e0548bda7a7f6e780

SHA256
38a9f462da9d386c4be8f7493bfe67fdfc77f4b847fd0f265cb1e961b4daf90d

SHA512
a2769407ec3d2c43ce201dfc886cd1132256b4eba1b9cba739db23dc8814d82f22e036524738c843495d48b8f5c3c39f56f06bae21b4070f18b2cde9bd8d01f7

Download Submit
memory/4740-17-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/4740-23-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/5104-0-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/5104-1-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/5104-2-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download