e10c62009239fb57a37399d4aaffd25c288ff81e91e0221c754e1a4e0e5bab45

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 00:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-21_6a9a47cd329b8516a247f8d6cafc7653_cryptolocker.exe
Size

88KB
MD5

6a9a47cd329b8516a247f8d6cafc7653
SHA1

9096a6507e58c4d284ccf06ef7e792733607af25
SHA256

e10c62009239fb57a37399d4aaffd25c288ff81e91e0221c754e1a4e0e5bab45
SHA512

67851520f40be13e098750f5da68c553054914b4d6ec0f027deea8d9f39035121a544a79ae5de6d625ba3da35461664b2ba4c9a8088956807d0ac4f42bf21f87
SSDEEP

1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOT7vM5RH:T6a+rdOOtEvwDpjNm

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	2024-09-21_6a9a47cd329b8516a247f8d6cafc7653_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4492	asih.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2816-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x000f000000023370-13.dat	upx
behavioral2/memory/2816-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4492-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-21_6a9a47cd329b8516a247f8d6cafc7653_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 4492	2816	2024-09-21_6a9a47cd329b8516a247f8d6cafc7653_cryptolocker.exe	91
PID 2816 wrote to memory of 4492	2816	2024-09-21_6a9a47cd329b8516a247f8d6cafc7653_cryptolocker.exe	91
PID 2816 wrote to memory of 4492	2816	2024-09-21_6a9a47cd329b8516a247f8d6cafc7653_cryptolocker.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-09-21_6a9a47cd329b8516a247f8d6cafc7653_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-21_6a9a47cd329b8516a247f8d6cafc7653_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4160,i,4356837537417149674,16553092232944545509,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:8
1⤵
PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
88KB

MD5
c9f869320be603f5b3a5f115239365b7

SHA1
b81c71c0bf5767c8ddffecc4fa73654ca147cf40

SHA256
aa82da5892e48f32032d1df4d1f28a13a736e98fcafb31b02560d52dde60d18e

SHA512
0e578233613637ea7222d9426dc3b1e778912bb3dffe7cde7b83d735c41c894810587d9b7b429b483a0b2c9198416ce7030e967a0f0c0d6bb0293cb3a41c78d2

Download Submit
memory/2816-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2816-1-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/2816-2-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/2816-3-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/2816-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4492-19-0x00000000020D0000-0x00000000020D6000-memory.dmp

Filesize
24KB

Download
memory/4492-20-0x0000000002100000-0x0000000002106000-memory.dmp

Filesize
24KB

Download
memory/4492-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download