a6841d9b2b6a4049dad27adbe44cb1510bd26bfd5f833a94f4c94014405d5497

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 05:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-20_492f5c6447ca235aacc4939dbb969057_cryptolocker.exe
Size

72KB
MD5

492f5c6447ca235aacc4939dbb969057
SHA1

7aba0c8984ff62d13545229d1881b932477addbd
SHA256

a6841d9b2b6a4049dad27adbe44cb1510bd26bfd5f833a94f4c94014405d5497
SHA512

867e9e8b6377840dedfed16116f7b7b06066502026d10dda9f0fee1245c11d3a750a9fe92b678296855b05e70f7ac8d4ab48971a1a571f32de3c2c80312eda42
SSDEEP

1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKUNZO5t:DW60sllyWOtEvwDpjwF85U

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	2024-11-20_492f5c6447ca235aacc4939dbb969057_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
244	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-20_492f5c6447ca235aacc4939dbb969057_cryptolocker.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 244	3116	2024-11-20_492f5c6447ca235aacc4939dbb969057_cryptolocker.exe	83
PID 3116 wrote to memory of 244	3116	2024-11-20_492f5c6447ca235aacc4939dbb969057_cryptolocker.exe	83
PID 3116 wrote to memory of 244	3116	2024-11-20_492f5c6447ca235aacc4939dbb969057_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-11-20_492f5c6447ca235aacc4939dbb969057_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-20_492f5c6447ca235aacc4939dbb969057_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
73KB

MD5
0b494363b14fe565ae6157fb03c0f8c9

SHA1
84ad23b8fde44f477bf0cca8d76a8783ad64df10

SHA256
891c25f3cae46db38e96f9bb761c6e2135b4a5c232780f58535da567f22f9c8a

SHA512
f5523ae6d55c9df63c785e3d85136e312475b8b49a662474fb702e51889ac4113bd5df0f19e6605593801e0e43f2d53e3f99aa0e7e01f6d584d031d13f315b4e

Download Submit
memory/244-20-0x0000000001FF0000-0x0000000001FF6000-memory.dmp

Filesize
24KB

Download
memory/244-19-0x0000000001FD0000-0x0000000001FD6000-memory.dmp

Filesize
24KB

Download
memory/244-26-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/3116-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/3116-1-0x00000000020D0000-0x00000000020D6000-memory.dmp

Filesize
24KB

Download
memory/3116-2-0x00000000020D0000-0x00000000020D6000-memory.dmp

Filesize
24KB

Download
memory/3116-3-0x0000000002100000-0x0000000002106000-memory.dmp

Filesize
24KB

Download
memory/3116-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download