43d6391abac98e884119d61016e161852ed72e1ec3358a6ca41faa0301930bca

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 07:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-08_c106e4f7aa7908e7bf9062fb3216d4cd_cryptolocker.exe
Size

80KB
MD5

c106e4f7aa7908e7bf9062fb3216d4cd
SHA1

26d8e159bb19fa7ec1a94114f47287256fbb91e1
SHA256

43d6391abac98e884119d61016e161852ed72e1ec3358a6ca41faa0301930bca
SHA512

a6dc0b9ff864fcfe07914b15db567dad299a6a0249e25fd06724acc9f1b523167d601e68a24bdd4dfe1f363b28d996478945362e4a6722e86c609a43c579fbf7
SSDEEP

1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOA+YSafiPuqdo:T6a+rdOOtEvwDpjNcB

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	2024-09-08_c106e4f7aa7908e7bf9062fb3216d4cd_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2560	asih.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2752-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x000900000002348b-13.dat	upx
behavioral2/memory/2752-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/2560-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-08_c106e4f7aa7908e7bf9062fb3216d4cd_cryptolocker.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2560	2752	2024-09-08_c106e4f7aa7908e7bf9062fb3216d4cd_cryptolocker.exe	85
PID 2752 wrote to memory of 2560	2752	2024-09-08_c106e4f7aa7908e7bf9062fb3216d4cd_cryptolocker.exe	85
PID 2752 wrote to memory of 2560	2752	2024-09-08_c106e4f7aa7908e7bf9062fb3216d4cd_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-09-08_c106e4f7aa7908e7bf9062fb3216d4cd_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-08_c106e4f7aa7908e7bf9062fb3216d4cd_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
81KB

MD5
44715fbdf5efab02ee428f63b5744023

SHA1
f2967c0d8408f7a440dbbb1ffb36cbb98e1a855a

SHA256
70c4db23aac88c384579dd9359f5018e8204d41cd8a2d53ee3b5433b82e0aa35

SHA512
3725cce1866b4f7b480109542b1a552ce4b5ea928008b833a9971b2365339e9dc57c957f715c6fcdf15fa47a02660fcb30c68e3fb85a13863cb24f3c19429a59

Download Submit
memory/2560-19-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2560-20-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/2560-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2752-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2752-1-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/2752-2-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/2752-3-0x00000000007D0000-0x00000000007D6000-memory.dmp

Filesize
24KB

Download
memory/2752-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download