ba5bf1a0d0a5ee99b1fdb35536a2b282ed30d8880a75efa0bec32a57cf2bdb06

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2024 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-03_ec7ff7fd5b19c94fb9f0a30c2fc764ae_cryptolocker.exe
Size

48KB
MD5

ec7ff7fd5b19c94fb9f0a30c2fc764ae
SHA1

34e58fdbbb3282e7dc3d33d52b74552ab835f9da
SHA256

ba5bf1a0d0a5ee99b1fdb35536a2b282ed30d8880a75efa0bec32a57cf2bdb06
SHA512

e1777610edb2c834bf72be97ff30bd88111fdca0460ee488bd1f7479c68b2826ee1749611c4cba550a68dd7d6e78a95c4e6685cd52202ba7990169e0c3ccc9bc
SSDEEP

768:79inqyNR/QtOOtEvwDpjBKccJVODvy3Z5T:79mqyNhQMOtEvwDpjBzckqXT

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	2024-10-03_ec7ff7fd5b19c94fb9f0a30c2fc764ae_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1300	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-03_ec7ff7fd5b19c94fb9f0a30c2fc764ae_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 1300	3144	2024-10-03_ec7ff7fd5b19c94fb9f0a30c2fc764ae_cryptolocker.exe	89
PID 3144 wrote to memory of 1300	3144	2024-10-03_ec7ff7fd5b19c94fb9f0a30c2fc764ae_cryptolocker.exe	89
PID 3144 wrote to memory of 1300	3144	2024-10-03_ec7ff7fd5b19c94fb9f0a30c2fc764ae_cryptolocker.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-10-03_ec7ff7fd5b19c94fb9f0a30c2fc764ae_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-03_ec7ff7fd5b19c94fb9f0a30c2fc764ae_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4264,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
1⤵
PID:1384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
48KB

MD5
39b3c43e73f2057f51344500402f3dda

SHA1
da114bb22220ff22240ff1a2b9884dc6c88c2eb6

SHA256
258289eb229f475d26c19a79ffdbfa6189c1f03326f41bec222852fa02bac392

SHA512
df680928aa351064afa28a93882f2263d0fb5e3bb313fea69ee60de08d1234726b55c6cc71dc0974b5bd1c5c1c9728b042d319de17d2d23a41916321c8d8c2b9

Download Submit
memory/1300-20-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/1300-19-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/1300-26-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3144-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3144-1-0x00000000007B0000-0x00000000007B6000-memory.dmp

Filesize
24KB

Download
memory/3144-2-0x00000000007B0000-0x00000000007B6000-memory.dmp

Filesize
24KB

Download
memory/3144-3-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/3144-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download