687403db3691b2cf576f00ea796a1e70ca4a23f266e16534856ead4178df3460

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-09_6209057efa73f766671c8db7732fadcd_cryptolocker.exe
Size

44KB
MD5

6209057efa73f766671c8db7732fadcd
SHA1

a0d68f339af06d6c8ece1be8ad2fb451bca47e66
SHA256

687403db3691b2cf576f00ea796a1e70ca4a23f266e16534856ead4178df3460
SHA512

c0c9a73ef6fd824caadadf579da09dee9eaf7e2717582503ac5395b29acd895f213c1c39d4979ce2f2212f03df6556859660659650eed5bf2a9b01fd0a38490a
SSDEEP

768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05WTWt:qmbhXDmjr5MOtEvwDpj5cDtKkQZQ6A

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	2024-10-09_6209057efa73f766671c8db7732fadcd_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4968	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-09_6209057efa73f766671c8db7732fadcd_cryptolocker.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 4968	2712	2024-10-09_6209057efa73f766671c8db7732fadcd_cryptolocker.exe	86
PID 2712 wrote to memory of 4968	2712	2024-10-09_6209057efa73f766671c8db7732fadcd_cryptolocker.exe	86
PID 2712 wrote to memory of 4968	2712	2024-10-09_6209057efa73f766671c8db7732fadcd_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-10-09_6209057efa73f766671c8db7732fadcd_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-09_6209057efa73f766671c8db7732fadcd_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
44KB

MD5
f7e6d71ed464fb2cf07392d59560be29

SHA1
8eabf1776ccc7cb91e59bb14b11b08a3f6d334d1

SHA256
1b226d150cf733a6cb4584174212bc67d46ccc492e4b0aa23dd41428e56726e4

SHA512
dbb4dac2e3281296537ef283bde59b2265ce4d9a24e5495aa61f5be61510d0314996a74ee137376cc137bb4717f44f45d2ce32f188cede44538404375dc42844

Download Submit
memory/2712-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2712-1-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download
memory/2712-2-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download
memory/2712-3-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/2712-19-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4968-20-0x0000000000650000-0x0000000000656000-memory.dmp

Filesize
24KB

Download
memory/4968-22-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/4968-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download