47b7408c77ce16ee0d6ad61e0dc4e48b5309221b9383ff48f864aa7e7acc8e48

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-21_b329a5c3db03e77cc65b6287f487632d_cryptolocker.exe
Size

62KB
MD5

b329a5c3db03e77cc65b6287f487632d
SHA1

e5531a9e917cfa6b623fdd9520fbeedc8702caab
SHA256

47b7408c77ce16ee0d6ad61e0dc4e48b5309221b9383ff48f864aa7e7acc8e48
SHA512

21f55c026a51a012e6bba86cdc2b04b1cf29b59a1e5c8d5167278cd0e582298fe94b4c737d1cd0c31db5e6350597551208b98b812e835957dcbe6e25a6ac235c
SSDEEP

1536:T6QFElP6n+gxmddpMOtEvwDpjwaYaQ8dy:T6a+rdOOtEvwDpjNO

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-11-21_b329a5c3db03e77cc65b6287f487632d_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	2024-11-21_b329a5c3db03e77cc65b6287f487632d_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2916 asih.exe

pid	process
2916	asih.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2216-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\asih.exe	upx
behavioral2/memory/2216-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/2916-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2024-11-21_b329a5c3db03e77cc65b6287f487632d_cryptolocker.exeasih.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-21_b329a5c3db03e77cc65b6287f487632d_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-11-21_b329a5c3db03e77cc65b6287f487632d_cryptolocker.exe

description	pid	process	target process
PID 2216 wrote to memory of 2916	2216	2024-11-21_b329a5c3db03e77cc65b6287f487632d_cryptolocker.exe	asih.exe
PID 2216 wrote to memory of 2916	2216	2024-11-21_b329a5c3db03e77cc65b6287f487632d_cryptolocker.exe	asih.exe
PID 2216 wrote to memory of 2916	2216	2024-11-21_b329a5c3db03e77cc65b6287f487632d_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-21_b329a5c3db03e77cc65b6287f487632d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-21_b329a5c3db03e77cc65b6287f487632d_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
62KB

MD5
c2463ea528a5d1989f7b1b301a98f701

SHA1
23600be676cb9217bf8f8210e9bf198b810aa23d

SHA256
ee6523e07a931645c32256c91343b991161f3711eee445073e4be909e5892b26

SHA512
6832bf83748d2f6f25a3785e53dd1f5f42d6bc6900a7ed3f6b2c2e0c19a9b9d6c44d3c64491a5b777c95470981087f39245b412bae7121811a31de57b25fc2cb

Download Submit
memory/2216-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2216-1-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/2216-2-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/2216-3-0x00000000021B0000-0x00000000021B6000-memory.dmp

Filesize
24KB

Download
memory/2216-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2916-19-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/2916-20-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/2916-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download