f1a5b06869ae1638bbad3e5786d0340affdbaca4c540186aab0f4206330a517a

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 05:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-13_fb5b0225da15727f67d29a5b477d3d10_cryptolocker.exe
Size

48KB
MD5

fb5b0225da15727f67d29a5b477d3d10
SHA1

e47423c08ff5aea73250ced9e26590e9cdf1b44a
SHA256

f1a5b06869ae1638bbad3e5786d0340affdbaca4c540186aab0f4206330a517a
SHA512

323830aab742e3d905f7e05c210c2d01e0f2432695b3159a44e5660dde315a2d454526225386d5cda9e8bdaa898c4c88796764802b70f9166caf4c5cd8dc1b2f
SSDEEP

768:26LsoVEeegiZPvEhHSP+gDdQtOOtEvwDpjtMLZdzuqpXsiE8Wq/DpkITYaW:26Q0ElP6G+gBQMOtEvwDpjgWMl7TYaW

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	2024-10-13_fb5b0225da15727f67d29a5b477d3d10_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3784	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-13_fb5b0225da15727f67d29a5b477d3d10_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 3784	4576	2024-10-13_fb5b0225da15727f67d29a5b477d3d10_cryptolocker.exe	85
PID 4576 wrote to memory of 3784	4576	2024-10-13_fb5b0225da15727f67d29a5b477d3d10_cryptolocker.exe	85
PID 4576 wrote to memory of 3784	4576	2024-10-13_fb5b0225da15727f67d29a5b477d3d10_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-10-13_fb5b0225da15727f67d29a5b477d3d10_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-13_fb5b0225da15727f67d29a5b477d3d10_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
48KB

MD5
399581aaac05a87dd204a50a015094a0

SHA1
8e8e9396e2c5383e4a58696bfbf561dc7d20b6fb

SHA256
3c8e756b1be387fc3953a53d8bb60bb087fb72534eb76e4a5f04ba4adc2a064f

SHA512
9bc7438d65a74015eb33bba55cc641ba1609763c7314a366acebaed219e8a847d6a2f195632d8c3ad951e73f0bd3266fb10af7e1f1c6983d79b93c18bc6a9d96

Download Submit
memory/3784-19-0x0000000000650000-0x0000000000656000-memory.dmp

Filesize
24KB

Download
memory/3784-25-0x0000000000630000-0x0000000000636000-memory.dmp

Filesize
24KB

Download
memory/3784-26-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/4576-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/4576-1-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/4576-2-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/4576-3-0x0000000000710000-0x0000000000716000-memory.dmp

Filesize
24KB

Download
memory/4576-18-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download