12779408ec718ae671b0fc800331d503eedf60f867d3a786a422ce206cbb5acf

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 08:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-04_1acf812f04f830ba2ea25e5abf146a63_cryptolocker.exe
Size

48KB
MD5

1acf812f04f830ba2ea25e5abf146a63
SHA1

933083c5a97bc522bdec331588bdb17f4ed29e5d
SHA256

12779408ec718ae671b0fc800331d503eedf60f867d3a786a422ce206cbb5acf
SHA512

e980ff32c51b39060ed4d99e06f0972e051f3f27a50508d6e9a0e97511fee72802dfc15fb0e5f18259fac53091b22022b9498e480548a97ac08864f0b0897790
SSDEEP

768:P6LsoEEeegiZPvEhHS5+Mh/QtOOtEvwDpjBpaD3TUogs/VXpAPc1:P6QFElP6k+MRQMOtEvwDpjBQpVXV

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	2024-10-04_1acf812f04f830ba2ea25e5abf146a63_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1932	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-04_1acf812f04f830ba2ea25e5abf146a63_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 1932	2588	2024-10-04_1acf812f04f830ba2ea25e5abf146a63_cryptolocker.exe	82
PID 2588 wrote to memory of 1932	2588	2024-10-04_1acf812f04f830ba2ea25e5abf146a63_cryptolocker.exe	82
PID 2588 wrote to memory of 1932	2588	2024-10-04_1acf812f04f830ba2ea25e5abf146a63_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-10-04_1acf812f04f830ba2ea25e5abf146a63_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-04_1acf812f04f830ba2ea25e5abf146a63_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
48KB

MD5
c4de6a46f1a7911c15ed32f1d8e8a897

SHA1
e7f65fe173d84754654e30d94e578c9cc8f240bb

SHA256
6689d79b20895f8acc244d4523bb4b16f8728c374e1d711a91b7545690fb5b69

SHA512
857c215f6924ffffefccfceb18e73b82e1f3465a61a5996a3cf3dfd9ce5f6c7a774b3eca37bc09227a139c6c0e6fc829bd6e9f94c7ed1ba15825961b792a3eec

Download Submit
memory/1932-25-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/1932-19-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/1932-26-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2588-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2588-1-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/2588-2-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/2588-3-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/2588-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download