a12cd773ed121002eabc07b99ad8088cc79be6c78808b13526d79018b35c65a4

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-21_921d156ea06ce8d1fa3ae580a6a0b2ce_cryptolocker.exe
Size

63KB
MD5

921d156ea06ce8d1fa3ae580a6a0b2ce
SHA1

5bd61f4baba4d9aab1bb9dbdfd8bc718f6d36bc4
SHA256

a12cd773ed121002eabc07b99ad8088cc79be6c78808b13526d79018b35c65a4
SHA512

f6e4e17eeb695dd221938abe8ecf92c5b8f5d9abb9527f9935b26173e06ce5f3a6569bd912a998e7754b0b3edc2c9c611fa7b489b168b5a123294d70a49dc491
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBccD2RuoNmuBLZ/xblzopM:X6a+SOtEvwDpjBrOr

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	2024-09-21_921d156ea06ce8d1fa3ae580a6a0b2ce_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
724	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-21_921d156ea06ce8d1fa3ae580a6a0b2ce_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 348 wrote to memory of 724	348	2024-09-21_921d156ea06ce8d1fa3ae580a6a0b2ce_cryptolocker.exe	82
PID 348 wrote to memory of 724	348	2024-09-21_921d156ea06ce8d1fa3ae580a6a0b2ce_cryptolocker.exe	82
PID 348 wrote to memory of 724	348	2024-09-21_921d156ea06ce8d1fa3ae580a6a0b2ce_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-09-21_921d156ea06ce8d1fa3ae580a6a0b2ce_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-21_921d156ea06ce8d1fa3ae580a6a0b2ce_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:348
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
63KB

MD5
4ed69d5fe5facdab3deb2720067c0317

SHA1
294884930f09d9648e95225cf1e375f1d4cd551e

SHA256
8acc0309577b01f8a2f3b565f339607f903f7ac25517cd6398754f4ebc22cb2a

SHA512
fad3ec51cee09d20e0c3ee0b91da58add7b58884ea4b342e60ff6dd7cb6bc33c949104b354e43bf677d4e3764f9e48dac6bb1fd62e6e0eddd451922236a2e994

Download Submit
memory/348-0-0x0000000000670000-0x0000000000676000-memory.dmp

Filesize
24KB

Download
memory/348-1-0x0000000000670000-0x0000000000676000-memory.dmp

Filesize
24KB

Download
memory/348-2-0x00000000021C0000-0x00000000021C6000-memory.dmp

Filesize
24KB

Download
memory/724-17-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/724-18-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download