560b57afe5a12712ebf5ae0cd31fd36550519c236174dba53f55313a24240a98

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-04_14c65f5e194587f56c0fa6e2b9b65f97_cryptolocker.exe
Size

55KB
MD5

14c65f5e194587f56c0fa6e2b9b65f97
SHA1

a97a367a3bcd7775c9e7409d96de0526b6e189d6
SHA256

560b57afe5a12712ebf5ae0cd31fd36550519c236174dba53f55313a24240a98
SHA512

8e7b3e13b0eb2e69538de43478b08c3dc9ca2636e6a40015c1709244baac6b13aef20c37ad862a155c246df89407fda065bad52fd70c88b5d49d9a6f66ddd836
SSDEEP

1536:z6QFElP6n+gKmddpMOtEvwDpj31ik/9+m:z6a+CdOOtEvwDpjZ

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	2024-10-04_14c65f5e194587f56c0fa6e2b9b65f97_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2228	asih.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5104-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x0009000000023452-13.dat	upx
behavioral2/memory/5104-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/2228-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-04_14c65f5e194587f56c0fa6e2b9b65f97_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 2228	5104	2024-10-04_14c65f5e194587f56c0fa6e2b9b65f97_cryptolocker.exe	84
PID 5104 wrote to memory of 2228	5104	2024-10-04_14c65f5e194587f56c0fa6e2b9b65f97_cryptolocker.exe	84
PID 5104 wrote to memory of 2228	5104	2024-10-04_14c65f5e194587f56c0fa6e2b9b65f97_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-10-04_14c65f5e194587f56c0fa6e2b9b65f97_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-04_14c65f5e194587f56c0fa6e2b9b65f97_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
55KB

MD5
ffa74a49415f5b256d1547fc877f7fc1

SHA1
fd70ce096432bb6a5a7d0fce0f959683537848a4

SHA256
cff5f6d228ebc6e52834eda646acdeae5febc45497860f5c38d7b8faa327520c

SHA512
960667dfe9a65a2b1d05187c44be5eb5bc188b61fe65367a15b874a5cac96f14a986d536b663556421738820eb5cef401a6b5197c5ec853df5300cf89342c04c

Download Submit
memory/2228-19-0x00000000004C0000-0x00000000004C6000-memory.dmp

Filesize
24KB

Download
memory/2228-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/5104-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/5104-1-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/5104-2-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/5104-3-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/5104-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download