Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/10/2024, 19:32

General

  • Target

    2024-10-17_8bb1aa2118026671dde5de2c2508e584_cryptolocker.exe

  • Size

    56KB

  • MD5

    8bb1aa2118026671dde5de2c2508e584

  • SHA1

    e86ce853b42c6210682461bce5bcd1503567b0ef

  • SHA256

    7e3d5dadb1b3f6c9083aba4c2f2a0b015c75caeaa159d33e6e7825ce475cc5c6

  • SHA512

    8df64da3b2664aae9fb856814c1fd62359f1f30bd35ad84d6165a81cb97e2a4a138bcab835cd097eb256ca765eb37fc04ef7fe2867b51f03fb51180cabff4a82

  • SSDEEP

    768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YMLam5ax848+h7:z6QFElP6n+gKmddpMOtEvwDpj9aYaV

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-17_8bb1aa2118026671dde5de2c2508e584_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-17_8bb1aa2118026671dde5de2c2508e584_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3200
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4204

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    56KB

    MD5

    e702b77da844b10f8ef840f9ad3beddc

    SHA1

    9431792600f583266c61cb64df500cac1b402fb2

    SHA256

    eb369a85686bb08482a9f40d6f9c19f923a87da07da5292838d355d8a2ee32b3

    SHA512

    2a0d75dd7452d50c966755682a1bc022246b40f3be0a98d942c4e83b1c89b9fe93081117461ed1a1322bf9f447fbbded2efdfde1244b6a71e90232b1688c7025

  • memory/3200-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/3200-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/3200-2-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/3200-3-0x00000000004F0000-0x00000000004F6000-memory.dmp

    Filesize

    24KB

  • memory/3200-18-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/4204-19-0x0000000002070000-0x0000000002076000-memory.dmp

    Filesize

    24KB

  • memory/4204-25-0x0000000000560000-0x0000000000566000-memory.dmp

    Filesize

    24KB

  • memory/4204-26-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB