adefcd1e6baac4484d48a40ec6c47f6ba8d52450a447bdea05d7e179ce0e1b7e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-12_1145664e64e38aa7f06d787c1e67f311_cryptolocker.exe
Size

48KB
MD5

1145664e64e38aa7f06d787c1e67f311
SHA1

d85caee16d74b6cfab532bbcbe040a041e31a78a
SHA256

adefcd1e6baac4484d48a40ec6c47f6ba8d52450a447bdea05d7e179ce0e1b7e
SHA512

67bf2b386931497521a31faa269bb5ce7132e10678e208d27b3e5b6b45080d7a4b2bcc7627799a845d790f4ebfd68108f1427e1cafd5fea7ee42f9394da74dec
SSDEEP

768:y6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpjbXOQ69zbjlAAX5e9zrn:y6QFElP6n+gMQMOtEvwDpjbizbR9XwzL

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	2024-09-12_1145664e64e38aa7f06d787c1e67f311_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4520	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-12_1145664e64e38aa7f06d787c1e67f311_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 4520	5008	2024-09-12_1145664e64e38aa7f06d787c1e67f311_cryptolocker.exe	83
PID 5008 wrote to memory of 4520	5008	2024-09-12_1145664e64e38aa7f06d787c1e67f311_cryptolocker.exe	83
PID 5008 wrote to memory of 4520	5008	2024-09-12_1145664e64e38aa7f06d787c1e67f311_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-09-12_1145664e64e38aa7f06d787c1e67f311_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-12_1145664e64e38aa7f06d787c1e67f311_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
48KB

MD5
9870681288ca99c01955a75bf5e67504

SHA1
32a0d4f21ab3c774dae5b33d538ab1d427069e66

SHA256
154f11776969b2228e162ed2daacc6f68aeda01ad5cef821d21ffa5b5fe6f7bb

SHA512
8ec3181cba2532e6eb5691b7ab1ceaa4a83379e03286acb9ae62180d5f6757937b636280a731afc5b90e923bcb88a7f10c2869d1e85ce4f9decc104229edc5b7

Download Submit
memory/4520-17-0x0000000000820000-0x0000000000826000-memory.dmp

Filesize
24KB

Download
memory/4520-23-0x0000000000800000-0x0000000000806000-memory.dmp

Filesize
24KB

Download
memory/5008-0-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/5008-1-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/5008-2-0x0000000002100000-0x0000000002106000-memory.dmp

Filesize
24KB

Download