67b1bf11d6d4f8db2d431ae453292a2f3129a4fb12863de99e31304461b830e9

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 05:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-25_7cadd6d7926d03688be485444600923b_cryptolocker.exe
Size

54KB
MD5

7cadd6d7926d03688be485444600923b
SHA1

5ba4f917ccbcbfd1a3e9f03c8b7408de87e9e667
SHA256

67b1bf11d6d4f8db2d431ae453292a2f3129a4fb12863de99e31304461b830e9
SHA512

a75a4e8c21c21f2321b60515bc0dc67fd35df547887deebabb0f887a2ed592f6e59e7b7c0efb40738b93a24b66f4faa875cf0241a007a58c7c34594d2b42af1a
SSDEEP

1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb617xQ6:BbdDmjr+OtEvwDpjM1

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	2024-09-25_7cadd6d7926d03688be485444600923b_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4516	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-25_7cadd6d7926d03688be485444600923b_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 4516	960	2024-09-25_7cadd6d7926d03688be485444600923b_cryptolocker.exe	83
PID 960 wrote to memory of 4516	960	2024-09-25_7cadd6d7926d03688be485444600923b_cryptolocker.exe	83
PID 960 wrote to memory of 4516	960	2024-09-25_7cadd6d7926d03688be485444600923b_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-09-25_7cadd6d7926d03688be485444600923b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-25_7cadd6d7926d03688be485444600923b_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:960
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
54KB

MD5
cd8ab6ca27fb2ba8f0dda088da3e2f26

SHA1
9f257ba0a87bee2d6cc6c4ba7943e3e24e88b796

SHA256
8befd527753c55911e833d4d24dd1174d1b40b746672a83f051a7ba03d4f12b1

SHA512
d05acf0164e3b61e77d0990a0f2757ecfe49647a2259b407fa5da93200a2fb4a4aaf1ef66ade07ebf09ef1fd50a5d4ee936e63403eddf60baf85eb4b5b7fb4ff

Download Submit
memory/960-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/960-1-0x0000000002200000-0x0000000002206000-memory.dmp

Filesize
24KB

Download
memory/960-2-0x0000000002200000-0x0000000002206000-memory.dmp

Filesize
24KB

Download
memory/960-3-0x0000000002220000-0x0000000002226000-memory.dmp

Filesize
24KB

Download
memory/960-18-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4516-20-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download
memory/4516-22-0x0000000002060000-0x0000000002066000-memory.dmp

Filesize
24KB

Download
memory/4516-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download