Analysis

  • max time kernel
    140s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-09-2024 06:06

General

  • Target

    CI72Locker.exe

  • Size

    885KB

  • MD5

    474a1e1ca5007bb4e991536db1f9785f

  • SHA1

    359d7566389da72e5f041530ba1924addfe6d989

  • SHA256

    34cc35802f6df73f69922a2e3dff873390c035e0be75ad487a4b3fe6fd534196

  • SHA512

    846ece776a7d0fa70710cb1267c18854e0f4d0513755b6a7e5cb66126f879398a761408f48cdc8dc80bcc45b65ad12c45d05094b841f26e6b6133a3bd0c86ad9

  • SSDEEP

    24576:Y4xIf6YkUttsiRfi5WIf0Ivum50E0JnM1G0T/15M1G0T/1:Y4xIf62zbezum50E0pM1T15M1T1

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CI72Locker.exe
    "C:\Users\Admin\AppData\Local\Temp\CI72Locker.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1920
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x2f4 0x4e0
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5012

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1920-8-0x0000000075390000-0x00000000753BF000-memory.dmp

    Filesize

    188KB

  • memory/1920-9-0x00000000751D0000-0x0000000075381000-memory.dmp

    Filesize

    1.7MB

  • memory/1920-11-0x0000000074F30000-0x0000000074F7D000-memory.dmp

    Filesize

    308KB

  • memory/1920-10-0x0000000074F80000-0x00000000751C2000-memory.dmp

    Filesize

    2.3MB

  • memory/1920-14-0x0000000074F80000-0x00000000751C2000-memory.dmp

    Filesize

    2.3MB

  • memory/1920-18-0x0000000074F80000-0x00000000751C2000-memory.dmp

    Filesize

    2.3MB

  • memory/1920-22-0x0000000074F80000-0x00000000751C2000-memory.dmp

    Filesize

    2.3MB

  • memory/1920-26-0x0000000074F80000-0x00000000751C2000-memory.dmp

    Filesize

    2.3MB

  • memory/1920-30-0x0000000074F80000-0x00000000751C2000-memory.dmp

    Filesize

    2.3MB

  • memory/1920-38-0x0000000074F80000-0x00000000751C2000-memory.dmp

    Filesize

    2.3MB