a576996691d335fbfaa23be64df556468f929c5a66f06fda88af722a72eca427

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-17_a5af762dd3c9ca5a1900903dbc265158_cryptolocker.exe
Size

61KB
MD5

a5af762dd3c9ca5a1900903dbc265158
SHA1

50af9468eac9203f48e4b8054e58497ccd2491e9
SHA256

a576996691d335fbfaa23be64df556468f929c5a66f06fda88af722a72eca427
SHA512

286a7d679413506f8bad423012d27a46defef29c08491898028ef12a24cb2706a2063ed6ad52611ad2b6626b4e0e5b82794c37409437c19df7033e24a548e7f1
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBccD2RuoNmuBLZ/W:X6a+SOtEvwDpjBrOu

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	2024-10-17_a5af762dd3c9ca5a1900903dbc265158_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1364	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-17_a5af762dd3c9ca5a1900903dbc265158_cryptolocker.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 1364	4292	2024-10-17_a5af762dd3c9ca5a1900903dbc265158_cryptolocker.exe	87
PID 4292 wrote to memory of 1364	4292	2024-10-17_a5af762dd3c9ca5a1900903dbc265158_cryptolocker.exe	87
PID 4292 wrote to memory of 1364	4292	2024-10-17_a5af762dd3c9ca5a1900903dbc265158_cryptolocker.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-10-17_a5af762dd3c9ca5a1900903dbc265158_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-17_a5af762dd3c9ca5a1900903dbc265158_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
61KB

MD5
f396b2fcdaa364d426f9967185e65ebf

SHA1
dbffe7aa281557d4f7274dbaecc5b174e8bafc0f

SHA256
2c820c9451b18dd6b94e9e94958d496e787296ce483ab9dc75fdb5fdce231a6e

SHA512
a40a3c2b3b14caa4d077d67f4445cc93aaf58cc878f18faf78862a7cbc767c7437e290efec5e6219cbed5afbefaf09a9883597bccf04749e970685ec4d2c453e

Download Submit
memory/1364-18-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/1364-17-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4292-0-0x00000000007F0000-0x00000000007F6000-memory.dmp

Filesize
24KB

Download
memory/4292-2-0x0000000000820000-0x0000000000826000-memory.dmp

Filesize
24KB

Download
memory/4292-1-0x00000000007F0000-0x00000000007F6000-memory.dmp

Filesize
24KB

Download