15ee00367c550285dcad58e1d6543515f6218366f341371f231e43e78600dccb

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-09_0ebda24c18cd80dc63cbb5f1066382e5_cryptolocker.exe
Size

65KB
MD5

0ebda24c18cd80dc63cbb5f1066382e5
SHA1

f5d4fa2686c7ff194e7f00aa58cbf66d77ddba14
SHA256

15ee00367c550285dcad58e1d6543515f6218366f341371f231e43e78600dccb
SHA512

cdac09ecc531881490f90a1031f6b5b9d63d344421d1a77e821ac75a520c6c3f007797644bbb8560ab4f08947423a2c86d5823e1c6d11e7d1ebcc2ba71a1b552
SSDEEP

1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgtsihry:BbdDmjr+OtEvwDpjM8N

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	2024-09-09_0ebda24c18cd80dc63cbb5f1066382e5_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2324	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-09_0ebda24c18cd80dc63cbb5f1066382e5_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 516 wrote to memory of 2324	516	2024-09-09_0ebda24c18cd80dc63cbb5f1066382e5_cryptolocker.exe	86
PID 516 wrote to memory of 2324	516	2024-09-09_0ebda24c18cd80dc63cbb5f1066382e5_cryptolocker.exe	86
PID 516 wrote to memory of 2324	516	2024-09-09_0ebda24c18cd80dc63cbb5f1066382e5_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-09-09_0ebda24c18cd80dc63cbb5f1066382e5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-09_0ebda24c18cd80dc63cbb5f1066382e5_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:516
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
65KB

MD5
5efc31809bd319e5155cda0a98a3ccf0

SHA1
1bb31413dddc82f20c3f8c6810c18480ac8ac7bd

SHA256
331d2dc453623ac4892a4e214c96d5155e344ea8156a8e86ecf3f5a4db206d59

SHA512
36891a43019e8da4d52bcbd099fd0d762d292d942baa75779ddb47fcbd59e647ab80023565cb4833419812320ae740cf8f6e2df2124b5e8cce99ff56c8088be8

Download Submit
memory/516-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/516-1-0x0000000000640000-0x0000000000646000-memory.dmp

Filesize
24KB

Download
memory/516-2-0x0000000000640000-0x0000000000646000-memory.dmp

Filesize
24KB

Download
memory/516-3-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/516-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2324-20-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download
memory/2324-19-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2324-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download