Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-10-2024 08:24

General

  • Target

    2024-10-31_43c5150c6d6825cac269ba0cb824806b_cryptolocker.exe

  • Size

    45KB

  • MD5

    43c5150c6d6825cac269ba0cb824806b

  • SHA1

    354fc6f7bb18d0a2320d1ea27fb76371797250cc

  • SHA256

    d303bf41e8a124f876bd5d58f17c532d89aafc15be60cc06dd26dd1f18e515fe

  • SHA512

    d112f490e22379eadfc968a2e3f0d58b664f61d500b365e92cbde138f20a156f6a05cf1d2ada35b6b4b2b6ef5aeed391e191b3dbb16323b82633cb03ecb56d78

  • SSDEEP

    768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaaEqbIu55Q:X6QFElP6n+gJQMOtEvwDpjB0GIWQ

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-31_43c5150c6d6825cac269ba0cb824806b_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-31_43c5150c6d6825cac269ba0cb824806b_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3544
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4580

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    45KB

    MD5

    8a53b5cd152b66b733737c7bef358d83

    SHA1

    44009f4fc90cd7724a7d50cd30c31ab25e8d68b3

    SHA256

    e8ca784bd06f55b0fb9c2031ffbb016cda74c059d7ff6bf7b029b5caf8b7a70e

    SHA512

    dcd11ca64dfd6d738ff100f4834a238cb9ea13393e0bf4ddbf128cc6f8c3f2ce4bd623ba89ed90c7c3f6f5ca2060829ee49433f8f8a0d8e668bc35f04e9a968e

  • memory/3544-0-0x00000000007D0000-0x00000000007D6000-memory.dmp

    Filesize

    24KB

  • memory/3544-1-0x00000000007D0000-0x00000000007D6000-memory.dmp

    Filesize

    24KB

  • memory/3544-2-0x00000000007F0000-0x00000000007F6000-memory.dmp

    Filesize

    24KB

  • memory/4580-18-0x00000000020F0000-0x00000000020F6000-memory.dmp

    Filesize

    24KB

  • memory/4580-17-0x0000000000660000-0x0000000000666000-memory.dmp

    Filesize

    24KB