df5e324d002abb0415b9d638d33425aec653bf2443aa74e0afaf5e2fd4554cbc

Analysis

max time kernel
136s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-24_a07e362f649a38a424bc6af5f00f0037_cryptolocker.exe
Size

46KB
MD5

a07e362f649a38a424bc6af5f00f0037
SHA1

1347ff7501104bc17e7b4c64b5adeaf1d1bd25f9
SHA256

df5e324d002abb0415b9d638d33425aec653bf2443aa74e0afaf5e2fd4554cbc
SHA512

b651f1eba2890acc92865c618cf46f455dfe41d01df5a4e3e8918b76435fac7711fecadf31188989e4eefd94292ff340a279467502fbda8e4eb88086e1478bfa
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpjeJQ7suIlsw92KFXckdBj:V6QFElP6n+gMQMOtEvwDpjeJQ7pojakn

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0009000000022480-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x0009000000022480-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	2024-01-24_a07e362f649a38a424bc6af5f00f0037_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1128	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 1128	1428	2024-01-24_a07e362f649a38a424bc6af5f00f0037_cryptolocker.exe	88
PID 1428 wrote to memory of 1128	1428	2024-01-24_a07e362f649a38a424bc6af5f00f0037_cryptolocker.exe	88
PID 1428 wrote to memory of 1128	1428	2024-01-24_a07e362f649a38a424bc6af5f00f0037_cryptolocker.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-01-24_a07e362f649a38a424bc6af5f00f0037_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-24_a07e362f649a38a424bc6af5f00f0037_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
47KB

MD5
882a57f932bd647b7b7f0cf57bf0f38a

SHA1
514717ee9a67e96ec041487c1606476a659aadde

SHA256
750577ab91728c8192d7d9a6386b455951ada8c7ccfe7e48e6cd3e05f8403bf9

SHA512
57e9f20732e35b0aec4e200a5be81615f1497a149a92bd54f00995fbd432bda74d26d921367062ff28d5856842a09a1731ebb17148b2776e264f512ca4369f07

Download Submit
memory/1128-17-0x0000000000820000-0x0000000000826000-memory.dmp

Filesize
24KB

Download
memory/1128-19-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/1428-0-0x0000000002310000-0x0000000002316000-memory.dmp

Filesize
24KB

Download
memory/1428-1-0x0000000002310000-0x0000000002316000-memory.dmp

Filesize
24KB

Download
memory/1428-2-0x0000000002180000-0x0000000002186000-memory.dmp

Filesize
24KB

Download