90ae594238ea2c517461ce9bfab7c18e1cad8f2a21fdf38c6f66cef668f0aeef

Analysis

max time kernel
0s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 07:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-21_db446aec98b840cbf19806b545c92d5c_cryptolocker.exe
Size

37KB
MD5

db446aec98b840cbf19806b545c92d5c
SHA1

3300b1a289a4d69fc9ab9b21836bcc0c0a8776f4
SHA256

90ae594238ea2c517461ce9bfab7c18e1cad8f2a21fdf38c6f66cef668f0aeef
SHA512

4e3b160043aa1b58125aff73ae8eb16f634e443cd44854330964e11ea8bf3c1cbce13ba6da8fd745e7de750a86dc77dd059cadcf9790cb6fb3be186e65005087
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpjeJQLI3J7f5/6:V6QFElP6n+gMQMOtEvwDpjeJQyTC

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	2024-11-21_db446aec98b840cbf19806b545c92d5c_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-21_db446aec98b840cbf19806b545c92d5c_cryptolocker.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-21_db446aec98b840cbf19806b545c92d5c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-21_db446aec98b840cbf19806b545c92d5c_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:2320
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  PID:3616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
37KB

MD5
0da471e7093a588b749048839a28fa65

SHA1
5c70d9aa8c8254dadbc2fcb5c17d9118b706f2b6

SHA256
066a396f779fcfca65b08b3caa302ab08a9f62f5a0e8487249a4ad75eb4cd487

SHA512
9c4ede70d4054acf3c3d033d157a4f1183fa304455c3381603966957491a59e378795310812b509d6254f8f12ad876d06123f371bc606c860c2e050416be7dcd

Download Submit
memory/2320-1-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/2320-2-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/2320-0-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download