Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/09/2024, 03:05

General

  • Target

    2024-09-08_aa54dca49e63d5b10bf1bd83a44db5c2_cryptolocker.exe

  • Size

    40KB

  • MD5

    aa54dca49e63d5b10bf1bd83a44db5c2

  • SHA1

    21a0e856bdd6076c1ebb49b3f4a78c00b420874f

  • SHA256

    9100f69eb1ef793d1c049409187e92924ab41dbf208e000100a239d088d7e43c

  • SHA512

    845338b6ec35ca1e43cf7fe54339592a2a4684212e514cbe852030e3a160e22c6d16a2f0b15425ef15cc9e7e5eb9849c081556d5e175d919ca077083c62f1d32

  • SSDEEP

    768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBVaD3TP7DFCw0xM:X6QFElP6n+gJQMOtEvwDpjBmzDU5xM

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-08_aa54dca49e63d5b10bf1bd83a44db5c2_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-08_aa54dca49e63d5b10bf1bd83a44db5c2_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4820
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:460

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\asih.exe

          Filesize

          40KB

          MD5

          f93809e3e64cadbb19bd6beb4114b856

          SHA1

          d5c77727afaef34cb2bbe0dce84d31ff4fa00d31

          SHA256

          95e601bec66c0173271d01f001302e33d8a5fe50675d9088d202ac5256c733f0

          SHA512

          d34c7d83d6ae5a697add358218a03407055805c28c37dcc1cd2217670492538c520b661a6e28b532d75d6f5cc9242a7897a1977beb98a77163330d6a7c15e311

        • memory/460-17-0x00000000006D0000-0x00000000006D6000-memory.dmp

          Filesize

          24KB

        • memory/460-23-0x0000000000660000-0x0000000000666000-memory.dmp

          Filesize

          24KB

        • memory/4820-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

          Filesize

          24KB

        • memory/4820-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

          Filesize

          24KB

        • memory/4820-2-0x00000000004F0000-0x00000000004F6000-memory.dmp

          Filesize

          24KB