e1f4db4a00381d9582977e1c1f3910e1a9ecee70fc7fee9111da7d23a6bec1c8

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-05_97a9c454833ac2dbe098475fc133c6ff_cryptolocker.exe
Size

72KB
MD5

97a9c454833ac2dbe098475fc133c6ff
SHA1

c0605477b370fedc33c0c5d4b44be3d2b80e0bcd
SHA256

e1f4db4a00381d9582977e1c1f3910e1a9ecee70fc7fee9111da7d23a6bec1c8
SHA512

d6d41d0505eef8d4c864207134b92f03f8462d230e449f13218c9f81d490ceb4042279a7f54c8ec1e14155b240856e77135ce73851c4aa6f5a2ab9d3c6568c31
SSDEEP

1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKUNZOn:DW60sllyWOtEvwDpjwF854

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	2024-09-05_97a9c454833ac2dbe098475fc133c6ff_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
5148	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-05_97a9c454833ac2dbe098475fc133c6ff_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 5148	2076	2024-09-05_97a9c454833ac2dbe098475fc133c6ff_cryptolocker.exe	84
PID 2076 wrote to memory of 5148	2076	2024-09-05_97a9c454833ac2dbe098475fc133c6ff_cryptolocker.exe	84
PID 2076 wrote to memory of 5148	2076	2024-09-05_97a9c454833ac2dbe098475fc133c6ff_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-09-05_97a9c454833ac2dbe098475fc133c6ff_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-05_97a9c454833ac2dbe098475fc133c6ff_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
72KB

MD5
4fb87486d08c17564a9cd88a6edb0224

SHA1
df1e95c3c7a0357c8ff20171d37cb174339be12b

SHA256
da6126a342410e6fec9f8ba73ce72ecafe0daa1e183fb7acffcc7a869a3ff55b

SHA512
88587563518eb5957dc5eca39a21fd980c37983d3ee962e2d2b017867faafcbe2a5d37e7dc1e2cf0cf2db4ff7af0067373b867bb5fe7151367ff635a68e02063

Download Submit
memory/2076-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2076-1-0x0000000000670000-0x0000000000676000-memory.dmp

Filesize
24KB

Download
memory/2076-2-0x0000000000670000-0x0000000000676000-memory.dmp

Filesize
24KB

Download
memory/2076-3-0x0000000000690000-0x0000000000696000-memory.dmp

Filesize
24KB

Download
memory/2076-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/5148-25-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/5148-19-0x00000000007D0000-0x00000000007D6000-memory.dmp

Filesize
24KB

Download
memory/5148-26-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download