Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 18:39
Behavioral task
behavioral1
Sample
2022-11-23_e5e0e65669da3a7fcd9f9080f5772d84_cryptolocker.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2022-11-23_e5e0e65669da3a7fcd9f9080f5772d84_cryptolocker.exe
Resource
win10v2004-20220901-en
General
-
Target
2022-11-23_e5e0e65669da3a7fcd9f9080f5772d84_cryptolocker.exe
-
Size
117KB
-
MD5
e5e0e65669da3a7fcd9f9080f5772d84
-
SHA1
c40f4071eb36b6f3c07baf7b6906ca55c15db7df
-
SHA256
6ee60438c45eb04575d2973bb4c84d5db0fd6247e1a89aa4b01c3dfe6bab54b6
-
SHA512
cdf6fea66903f7aae1b516f093cbe3ab8b526f0af242396e97abd4d4a36bc9c89872abcc98f5d0df34901a1e3d1eae8ff08823164ea8a1d6b157ff9e344393c6
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwNgp69u:z6a+CdOOtEvwDpjcz0
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
asih.exepid process 3244 asih.exe -
Processes:
resource yara_rule behavioral2/memory/4460-132-0x0000000000500000-0x0000000000510000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\asih.exe upx C:\Users\Admin\AppData\Local\Temp\asih.exe upx behavioral2/memory/3244-145-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral2/memory/4460-146-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral2/memory/3244-154-0x0000000000500000-0x0000000000510000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2022-11-23_e5e0e65669da3a7fcd9f9080f5772d84_cryptolocker.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 2022-11-23_e5e0e65669da3a7fcd9f9080f5772d84_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2022-11-23_e5e0e65669da3a7fcd9f9080f5772d84_cryptolocker.exedescription pid process target process PID 4460 wrote to memory of 3244 4460 2022-11-23_e5e0e65669da3a7fcd9f9080f5772d84_cryptolocker.exe asih.exe PID 4460 wrote to memory of 3244 4460 2022-11-23_e5e0e65669da3a7fcd9f9080f5772d84_cryptolocker.exe asih.exe PID 4460 wrote to memory of 3244 4460 2022-11-23_e5e0e65669da3a7fcd9f9080f5772d84_cryptolocker.exe asih.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2022-11-23_e5e0e65669da3a7fcd9f9080f5772d84_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2022-11-23_e5e0e65669da3a7fcd9f9080f5772d84_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\asih.exeFilesize
117KB
MD5a8138578ae5d3a93643c646a23bfacfe
SHA1eecb78493b27c497691d2e11803e1fa4cafeb838
SHA256f1588034410a38f771b00784f74e0d6703aad5f619f6e49d7b2189544e652db5
SHA512015cffb6ceac634c2b7c06b1d686f4044ef7381eb692b402c061669dc5383b59298b2b599aa3f298b853cca1b911cba68f595d8f4b1ef642b6fc120665a83f32
-
C:\Users\Admin\AppData\Local\Temp\asih.exeFilesize
117KB
MD5a8138578ae5d3a93643c646a23bfacfe
SHA1eecb78493b27c497691d2e11803e1fa4cafeb838
SHA256f1588034410a38f771b00784f74e0d6703aad5f619f6e49d7b2189544e652db5
SHA512015cffb6ceac634c2b7c06b1d686f4044ef7381eb692b402c061669dc5383b59298b2b599aa3f298b853cca1b911cba68f595d8f4b1ef642b6fc120665a83f32
-
memory/3244-140-0x0000000000000000-mapping.dmp
-
memory/3244-147-0x00000000005B0000-0x00000000005B6000-memory.dmpFilesize
24KB
-
memory/3244-145-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/3244-153-0x0000000000590000-0x0000000000596000-memory.dmpFilesize
24KB
-
memory/3244-154-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/4460-133-0x00000000007B0000-0x00000000007B6000-memory.dmpFilesize
24KB
-
memory/4460-132-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/4460-134-0x00000000007D0000-0x00000000007D6000-memory.dmpFilesize
24KB
-
memory/4460-143-0x00000000007B0000-0x00000000007B6000-memory.dmpFilesize
24KB
-
memory/4460-146-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB