82797002a61848ac7b6c9f9e223ae48639c3b8ba5f9a642440b79173d8f1b2a6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 02:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-09-28_5d54ada6082f5d5e62d7f3460434fe02_cryptolocker.exe
Size

50KB
MD5

5d54ada6082f5d5e62d7f3460434fe02
SHA1

69dc42bd3c2a1713cc74e306bc69ff3fc518fe12
SHA256

82797002a61848ac7b6c9f9e223ae48639c3b8ba5f9a642440b79173d8f1b2a6
SHA512

7c8df0abf9d08d624e993643ec4c745278118d1bebe5d332277b45c78a264ee095b5ce19a8aa0211d91e259f0ffb81508de6e8b0373b552674e86519d83c962b
SSDEEP

768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/DpkcBJJ:P6Q0ElP6G+gJQMOtEvwDpjB8WMlfh

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	2024-09-28_5d54ada6082f5d5e62d7f3460434fe02_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3860	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-28_5d54ada6082f5d5e62d7f3460434fe02_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 3860	5092	2024-09-28_5d54ada6082f5d5e62d7f3460434fe02_cryptolocker.exe	82
PID 5092 wrote to memory of 3860	5092	2024-09-28_5d54ada6082f5d5e62d7f3460434fe02_cryptolocker.exe	82
PID 5092 wrote to memory of 3860	5092	2024-09-28_5d54ada6082f5d5e62d7f3460434fe02_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-09-28_5d54ada6082f5d5e62d7f3460434fe02_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-28_5d54ada6082f5d5e62d7f3460434fe02_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
50KB

MD5
53033a65337038b2499075a97784c035

SHA1
511fd267ab5ed54f1faa35bd6ac8b80ac7aecb42

SHA256
46da172b89b8221657a345f3d0a9f28b3287fca7af1ffa9dcb55e52c6244998f

SHA512
162598884f0e09172cacfb7058a1e5077b3f4ac1fce986462677ce475659c76efbbdba93573b4c7ed4a580e80438e09c2e0da414b72cd39bc342617ebc84a718

Download Submit
memory/3860-20-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/3860-19-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/3860-26-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/5092-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/5092-1-0x00000000021C0000-0x00000000021C6000-memory.dmp

Filesize
24KB

Download
memory/5092-2-0x00000000021C0000-0x00000000021C6000-memory.dmp

Filesize
24KB

Download
memory/5092-3-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/5092-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download