ee3de250f55101c64af50e83462382c55be8ef4c49b14c9d7112f2994ae84da1

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-28_756476e68c12d0fd9c4035fbc1d24062_cryptolocker.exe
Size

46KB
MD5

756476e68c12d0fd9c4035fbc1d24062
SHA1

843e497b72df05d3d747ecd5346dd4eb47d6266b
SHA256

ee3de250f55101c64af50e83462382c55be8ef4c49b14c9d7112f2994ae84da1
SHA512

dd1fc02f77ec290375b7dc5c94e472eae3872f03020870fa15d79db66ff0c35eced226569a22afe6d1c0a43117a85f752a66577756519fb18242675fa478b706
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLaHaMMm2X30E3aF:V6QFElP6n+gMQMOtEvwDpjyaHaXmF

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023217-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023217-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	2024-01-28_756476e68c12d0fd9c4035fbc1d24062_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3064	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 3064	1840	2024-01-28_756476e68c12d0fd9c4035fbc1d24062_cryptolocker.exe	89
PID 1840 wrote to memory of 3064	1840	2024-01-28_756476e68c12d0fd9c4035fbc1d24062_cryptolocker.exe	89
PID 1840 wrote to memory of 3064	1840	2024-01-28_756476e68c12d0fd9c4035fbc1d24062_cryptolocker.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-01-28_756476e68c12d0fd9c4035fbc1d24062_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-28_756476e68c12d0fd9c4035fbc1d24062_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
46KB

MD5
e81c3e39efd024fd64b4713a155e1e34

SHA1
f3f177e677a682434b131da7d1ecc9f352e6da03

SHA256
59eb9121ea55d85dc6d325a76a0a1d7f6cd7c2ba42d22e17f288537a2239c8d0

SHA512
0a9ebe1a07f9f0f7b849e587c1f543b3a5bcc810b4e703b28c5db368f93ec9bc3eab27f4b576052bae01f65b80986be66d0603dd2155660da3ca396600120c91

Download Submit
memory/1840-0-0x00000000021A0000-0x00000000021A6000-memory.dmp

Filesize
24KB

Download
memory/1840-1-0x00000000021A0000-0x00000000021A6000-memory.dmp

Filesize
24KB

Download
memory/1840-2-0x00000000021C0000-0x00000000021C6000-memory.dmp

Filesize
24KB

Download
memory/3064-17-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/3064-20-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download