71a21955231df766b59d6973b6fd8f5aafc48d79753bf63e124a17ef98f72079

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 01:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-09-07_27d4d9954ef9f35a9285b2fd926b4c40_cryptolocker.exe
Size

46KB
MD5

27d4d9954ef9f35a9285b2fd926b4c40
SHA1

9d6e43333b7288470a8009a94ba015b9caf93c55
SHA256

71a21955231df766b59d6973b6fd8f5aafc48d79753bf63e124a17ef98f72079
SHA512

db72595ef966f464a5c4235c8c7ddf7257906e68d598bbea9678792876e29e8986ea8bcb488e25d59a2ba3e80bc92b7d2adc9937939d4337a1c3454b6dee924d
SSDEEP

768:P6LsoEEeegiZPvEhHS5+Mh/QtOOtEvwDpjBpaD3TUogs/VXpAPH:P6QFElP6k+MRQMOtEvwDpjBQpVXq

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	2024-09-07_27d4d9954ef9f35a9285b2fd926b4c40_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
944	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-07_27d4d9954ef9f35a9285b2fd926b4c40_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 944	1204	2024-09-07_27d4d9954ef9f35a9285b2fd926b4c40_cryptolocker.exe	86
PID 1204 wrote to memory of 944	1204	2024-09-07_27d4d9954ef9f35a9285b2fd926b4c40_cryptolocker.exe	86
PID 1204 wrote to memory of 944	1204	2024-09-07_27d4d9954ef9f35a9285b2fd926b4c40_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-09-07_27d4d9954ef9f35a9285b2fd926b4c40_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-07_27d4d9954ef9f35a9285b2fd926b4c40_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
46KB

MD5
d135624dd1f10018830b84eabc0b12df

SHA1
63d69ab1b26c02d2b6de755a6a02ee80512e9e20

SHA256
08033d447891ea5a1d8a25550404258cd49ca1abb4a3e12cf1d7440b0f92ff15

SHA512
e1da85e87e087d68588bb2db6ee3d314e7c9d917e2a5d8cbf94625ef0bb432c6c7ac423311e9023ef37ee4509a948dc059218f41bcb76c72e64befe5b9be6cec

Download Submit
memory/944-19-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/944-20-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/944-26-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1204-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1204-1-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/1204-2-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/1204-3-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/1204-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download