fdf0628b8750a40ee37b1fdcd1030f6b6bd178608b02e2741552151df4a2f54d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 06:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-10_edb055fcb2fdb11e279829ca54e658af_cryptolocker.exe
Size

44KB
MD5

edb055fcb2fdb11e279829ca54e658af
SHA1

5da4a9bf182c471bc07bb3b3a069e4b8970e134a
SHA256

fdf0628b8750a40ee37b1fdcd1030f6b6bd178608b02e2741552151df4a2f54d
SHA512

a14e2b3d5605694462e2c75128b2be1164c874fb6075c7cb3487558f04bf0cb09358318b7f4f047cd1a54f0ef16add00bf1a62ace9f2d7aad362dafacbdd8dfd
SSDEEP

768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkL7vF1Ta:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkLa

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	2024-10-10_edb055fcb2fdb11e279829ca54e658af_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2684	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-10_edb055fcb2fdb11e279829ca54e658af_cryptolocker.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2684	2872	2024-10-10_edb055fcb2fdb11e279829ca54e658af_cryptolocker.exe	86
PID 2872 wrote to memory of 2684	2872	2024-10-10_edb055fcb2fdb11e279829ca54e658af_cryptolocker.exe	86
PID 2872 wrote to memory of 2684	2872	2024-10-10_edb055fcb2fdb11e279829ca54e658af_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-10-10_edb055fcb2fdb11e279829ca54e658af_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-10_edb055fcb2fdb11e279829ca54e658af_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
44KB

MD5
3233a944af9ecf8ae443ab603c93bd71

SHA1
e7946b3c65764f2d91cc9e54ebdd62aa6e004095

SHA256
9ea7dd65444563bf0da0fa6572d38408c6efdb2e898ddb0f98482c4cc2697aff

SHA512
d8c80002c6a40613eb5e82d5ab9f729f76b942e03d5378394609a3060ade9ecbca07b712080b78908f747a985df6fb92c21fb1d5ce332c355629fa4b5846532c

Download Submit
memory/2684-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2684-20-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/2684-21-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/2684-27-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2872-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2872-1-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/2872-2-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/2872-3-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/2872-18-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download