3918bac317800f8feb902fa82b2bce43ff780f3bf2c03c13b0aabeda949916ae

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 05:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-14_ed99d3d721138d450eb748733de52fe2_cryptolocker.exe
Size

76KB
MD5

ed99d3d721138d450eb748733de52fe2
SHA1

e6d3be4bd05bce1c9b439f9eb105f748f78973ba
SHA256

3918bac317800f8feb902fa82b2bce43ff780f3bf2c03c13b0aabeda949916ae
SHA512

79127b2c2b2d6b714a6da6ebee1a32f3574c086163efd3acfa5f3b33683e5d176db3bb28a8954582a8a0ccebf07b2968f3a37024eab68600ca4c4cd1377c2664
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1rHs6:X6a+SOtEvwDpjBZYvQd2x

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	2024-10-14_ed99d3d721138d450eb748733de52fe2_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3024	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-14_ed99d3d721138d450eb748733de52fe2_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 3024	3056	2024-10-14_ed99d3d721138d450eb748733de52fe2_cryptolocker.exe	86
PID 3056 wrote to memory of 3024	3056	2024-10-14_ed99d3d721138d450eb748733de52fe2_cryptolocker.exe	86
PID 3056 wrote to memory of 3024	3056	2024-10-14_ed99d3d721138d450eb748733de52fe2_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-10-14_ed99d3d721138d450eb748733de52fe2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-14_ed99d3d721138d450eb748733de52fe2_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
77KB

MD5
43198d060b7bc63ce8bbced69051a169

SHA1
4c733dc416f3a4539416ec80f7b264aac3246f9e

SHA256
23911bfefa004bafece465f6921a888ccb588543c0f1a074f2fd601c2f8724f5

SHA512
7d46eb4b76ec370bd0e3498c565b03d54d772463a333c7c86d62ff3f28f76df79a4d7947b85e26947f0e21c305e50ecde307ce613a4c38fa32f2abcf13a1baeb

Download Submit
memory/3024-17-0x00000000007B0000-0x00000000007B6000-memory.dmp

Filesize
24KB

Download
memory/3024-18-0x00000000007D0000-0x00000000007D6000-memory.dmp

Filesize
24KB

Download
memory/3056-0-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/3056-1-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/3056-2-0x0000000002230000-0x0000000002236000-memory.dmp

Filesize
24KB

Download