3c3d6438b49dc948108215259c4fdb4c1af6780dca05246ed68dae3a489db670

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 07:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-01_c9a2adc7f16939ccd792424239277bc5_cryptolocker.exe
Size

44KB
MD5

c9a2adc7f16939ccd792424239277bc5
SHA1

6135e2b3be69de1e6b73c840057eb7f8fe6466e7
SHA256

3c3d6438b49dc948108215259c4fdb4c1af6780dca05246ed68dae3a489db670
SHA512

a9a86b50dc2279b2a880397116222b3b91f01f3d95ad66fcaca267ecb296c17e038bfb6336a7bea82041f4c0c00e08cc085a34b90a3ef5f2220cedb727a366f0
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaac4HK/wSvuQTCyD/95WQW:X6QFElP6n+gJQMOtEvwDpjBsYK/fbDF8

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	2024-10-01_c9a2adc7f16939ccd792424239277bc5_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
116	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-01_c9a2adc7f16939ccd792424239277bc5_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 116	2588	2024-10-01_c9a2adc7f16939ccd792424239277bc5_cryptolocker.exe	82
PID 2588 wrote to memory of 116	2588	2024-10-01_c9a2adc7f16939ccd792424239277bc5_cryptolocker.exe	82
PID 2588 wrote to memory of 116	2588	2024-10-01_c9a2adc7f16939ccd792424239277bc5_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-10-01_c9a2adc7f16939ccd792424239277bc5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-01_c9a2adc7f16939ccd792424239277bc5_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
45KB

MD5
85588210f2e45fba4dc31ed87cf44970

SHA1
abd2f46e48bd6e3fc12a96db11011ca0c1601fa1

SHA256
2acadacf866d8245b42699aa3e1a0f09012eea32d997ea679ee4833214abc3dc

SHA512
9e26a21182aaa1dd48f84f08ce513ba5bc08fee4af8a76952bba8bc062188d8fc125214c296bf80f6d0c1ea344382d3e41a59c6d08b3fd10c527b7aec1ddbca5

Download Submit
memory/116-17-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/116-18-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/2588-0-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/2588-1-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/2588-2-0x0000000002230000-0x0000000002236000-memory.dmp

Filesize
24KB

Download