28543ad52a0f9f952f73f0cf372e45b4210cc8d2d901079e428f57dbc6bfbd3d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2024, 13:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-04_1fcc79ebd6e7f36785c06c2062b2bc8b_cryptolocker.exe
Size

44KB
MD5

1fcc79ebd6e7f36785c06c2062b2bc8b
SHA1

a00e17cde1c2818e4f7205478d876a791940c807
SHA256

28543ad52a0f9f952f73f0cf372e45b4210cc8d2d901079e428f57dbc6bfbd3d
SHA512

d5aa2f333e6ebe7a6cfe9a3b065dfd7379ab35434ad210f3b8cbbbb912f188ac5cf5e4245c3c198731ee2550ea64b99599b4f07e492949218b45a0191ceace31
SSDEEP

768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkL7vF1T2:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkL2

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	2024-09-04_1fcc79ebd6e7f36785c06c2062b2bc8b_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3548	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-04_1fcc79ebd6e7f36785c06c2062b2bc8b_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 3548	2232	2024-09-04_1fcc79ebd6e7f36785c06c2062b2bc8b_cryptolocker.exe	86
PID 2232 wrote to memory of 3548	2232	2024-09-04_1fcc79ebd6e7f36785c06c2062b2bc8b_cryptolocker.exe	86
PID 2232 wrote to memory of 3548	2232	2024-09-04_1fcc79ebd6e7f36785c06c2062b2bc8b_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-09-04_1fcc79ebd6e7f36785c06c2062b2bc8b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-04_1fcc79ebd6e7f36785c06c2062b2bc8b_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
44KB

MD5
9b600ce5c29c89895dbe3931349660e4

SHA1
f0adbd9b29fe2d831ac9c7706ebeef982f5159dc

SHA256
632ba3420b29fa20c93f5a8b0d7f7d4da711a3ce5c30545327d3040cd8378bc7

SHA512
5a6bbdca94554fee85f72e39213e03664f7c9395b29de1aad9a87914b4ae02e223b4f318820f0e48aebe224896dac9281d73b4baaa961c8527bc8c6a1b476ce7

Download Submit
memory/2232-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2232-1-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/2232-2-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/2232-3-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/2232-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/3548-19-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/3548-20-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/3548-26-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download