9332e77eb48770745d11aceba93bc5c63cd6f8b6d39ba36746f10f1d92c26429

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-20_941e72bc1f1e0e3c5d74d98211376956_cryptolocker.exe
Size

32KB
MD5

941e72bc1f1e0e3c5d74d98211376956
SHA1

7a7c6c378166b6ed3dad9d2df78b434d4bda5620
SHA256

9332e77eb48770745d11aceba93bc5c63cd6f8b6d39ba36746f10f1d92c26429
SHA512

bb58e9ebb36e36161dd9fb9b7d27863286c9f9a4c88225ec15d59fb59555b2248e46b5621bf29bf18f23ada3df2157939c99001038446f84b6001950626b4519
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjB9iNLY:X6QFElP6n+gJQMOtEvwDpjBN

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	2024-11-20_941e72bc1f1e0e3c5d74d98211376956_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2776	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-20_941e72bc1f1e0e3c5d74d98211376956_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 2776	4564	2024-11-20_941e72bc1f1e0e3c5d74d98211376956_cryptolocker.exe	84
PID 4564 wrote to memory of 2776	4564	2024-11-20_941e72bc1f1e0e3c5d74d98211376956_cryptolocker.exe	84
PID 4564 wrote to memory of 2776	4564	2024-11-20_941e72bc1f1e0e3c5d74d98211376956_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-11-20_941e72bc1f1e0e3c5d74d98211376956_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-20_941e72bc1f1e0e3c5d74d98211376956_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
32KB

MD5
b04eb2bc45ac7bdef9387521852f98f0

SHA1
a8d3a29249ae0b31b3b38088809e0ba51f96924a

SHA256
de1a3cd7e40b7248b32b0a03245a56620ad0ad2e598a7fbe38ea2f6aa5d172f4

SHA512
76ced1ba7f903143027889bd4ca44339e9770a1dfdf74b1343161da9a2a9b0dcb526ba829669128336a5c5991e68fef86bf19808fc0c234a76da3166dea01e4c

Download Submit
memory/2776-17-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/2776-23-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/4564-0-0x0000000000800000-0x0000000000806000-memory.dmp

Filesize
24KB

Download
memory/4564-1-0x0000000000800000-0x0000000000806000-memory.dmp

Filesize
24KB

Download
memory/4564-2-0x00000000021C0000-0x00000000021C6000-memory.dmp

Filesize
24KB

Download