aca3ea6c430f5eac5eb6b5a755dd93300b4ed261bfc0ea5fc7e5987da6f5e8fb

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-05_7c4800416c7abd4074f5e87bbeab6f96_cryptolocker.exe
Size

41KB
MD5

7c4800416c7abd4074f5e87bbeab6f96
SHA1

d3bb47dc50d32ebda76987c3beacb6a6df1107bb
SHA256

aca3ea6c430f5eac5eb6b5a755dd93300b4ed261bfc0ea5fc7e5987da6f5e8fb
SHA512

09faa48158c1df06b6f71eb697fc82497a2aa00b22dd35e0ea50be472b264999bf1c870eba1856ab80605cc7459ed53e4cd036e2e07b5720470fe1e5f89042c2
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLam5axRVZHw:V6QFElP6n+gMQMOtEvwDpjyaYaLQ

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	2024-09-05_7c4800416c7abd4074f5e87bbeab6f96_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1804	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-05_7c4800416c7abd4074f5e87bbeab6f96_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 1804	408	2024-09-05_7c4800416c7abd4074f5e87bbeab6f96_cryptolocker.exe	91
PID 408 wrote to memory of 1804	408	2024-09-05_7c4800416c7abd4074f5e87bbeab6f96_cryptolocker.exe	91
PID 408 wrote to memory of 1804	408	2024-09-05_7c4800416c7abd4074f5e87bbeab6f96_cryptolocker.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-09-05_7c4800416c7abd4074f5e87bbeab6f96_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-05_7c4800416c7abd4074f5e87bbeab6f96_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:408
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4460,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:8
1⤵
PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
41KB

MD5
08bbd0f32fc640458b5bbc05c0f81146

SHA1
86f52e7b13364a7b8b6a78ee11cca3d46c4a64cc

SHA256
6c123ab6569407618ff20d9fdbbee7265199314f8804d9d3fc3920983a202fe5

SHA512
8e1b03cbc49dd81446d1050d24dd5e4be8d953f6471437335d514da96820e05e3804f7a200d74e83b8de6ce5bb295ccda0ae1f486898b919dd1e9658a0c8b43e

Download Submit
memory/408-0-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/408-1-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/408-2-0x0000000000810000-0x0000000000816000-memory.dmp

Filesize
24KB

Download
memory/1804-18-0x00000000007D0000-0x00000000007D6000-memory.dmp

Filesize
24KB

Download
memory/1804-17-0x00000000007B0000-0x00000000007B6000-memory.dmp

Filesize
24KB

Download