757f89539a513edf3fc0ccefe2c15ffe2cf5d21f9909842e1ecd2b0b6c95184e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 05:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-21_8f6e89275659fc040b8adc4abe188dba_cryptolocker.exe
Size

47KB
MD5

8f6e89275659fc040b8adc4abe188dba
SHA1

fe90b3868d232d41637b285e29072d76d08853d4
SHA256

757f89539a513edf3fc0ccefe2c15ffe2cf5d21f9909842e1ecd2b0b6c95184e
SHA512

26ea8be6d8e2ef3071bbbb5c919611f58304928d478b30e8e9695d5bbca898c05369d206728b23989ebc7da503b589fea32205a32808b478a5cd36a09b012f37
SSDEEP

768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05WtyU8jf:qmbhXDmjr5MOtEvwDpj5cDtKkQZQPdUQ

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	2024-09-21_8f6e89275659fc040b8adc4abe188dba_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3500	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-21_8f6e89275659fc040b8adc4abe188dba_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 3500	5088	2024-09-21_8f6e89275659fc040b8adc4abe188dba_cryptolocker.exe	82
PID 5088 wrote to memory of 3500	5088	2024-09-21_8f6e89275659fc040b8adc4abe188dba_cryptolocker.exe	82
PID 5088 wrote to memory of 3500	5088	2024-09-21_8f6e89275659fc040b8adc4abe188dba_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-09-21_8f6e89275659fc040b8adc4abe188dba_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-21_8f6e89275659fc040b8adc4abe188dba_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
47KB

MD5
fc060219dc45e8c48e79ed6ea329203b

SHA1
1fcf4df352829b6d95ac46b86789bfdbd535678b

SHA256
b623eac56811560b3c9a4e4b129b92dce5698b2f3ddeed6f216420dad1c35440

SHA512
a9a6d22038dc8795d5ba83276d56909a8476bb3a0b7851e33c491af1883047654027bf3648d2145f3cfb1615418aa6ccc8f6172e257bacfabc2c15d527eb729f

Download Submit
memory/3500-20-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/3500-26-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/3500-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/5088-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/5088-1-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download
memory/5088-2-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download
memory/5088-3-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/5088-18-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download