a43446b2bf092d7a689c661a16e3e7c552dbabff82a985788d71bd96601b78fd

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2024, 11:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-02_0a2fb5ee83fc16f1406efe2cfe5b28bf_cryptolocker.exe
Size

83KB
MD5

0a2fb5ee83fc16f1406efe2cfe5b28bf
SHA1

7b7716bb6773bbdca476d4699baf1a221e404c30
SHA256

a43446b2bf092d7a689c661a16e3e7c552dbabff82a985788d71bd96601b78fd
SHA512

ff8c342ceb712242ef27c194f80d6417d7b9ea02190733e862f868a3d3babb60f4cd433c126d5f226c2c7c02aa4dce3db3e3a4a4812a1448fc6d376d7a76954d
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjyaLccVNlVSL8S:V6a+pOtEvwDpjvpQ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231fc-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231fc-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	2024-02-02_0a2fb5ee83fc16f1406efe2cfe5b28bf_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3644	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 3644	4764	2024-02-02_0a2fb5ee83fc16f1406efe2cfe5b28bf_cryptolocker.exe	84
PID 4764 wrote to memory of 3644	4764	2024-02-02_0a2fb5ee83fc16f1406efe2cfe5b28bf_cryptolocker.exe	84
PID 4764 wrote to memory of 3644	4764	2024-02-02_0a2fb5ee83fc16f1406efe2cfe5b28bf_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-02_0a2fb5ee83fc16f1406efe2cfe5b28bf_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-02_0a2fb5ee83fc16f1406efe2cfe5b28bf_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
83KB

MD5
72268bdf29031613f369c309706b26a7

SHA1
2fc66b8f91020fe7981a00b1dc08cf59635c5605

SHA256
6065782561cd3b404989d8b2e445f8f16131882c530bcaa271fc68af44512408

SHA512
4686d8cb2336fcb8cec24805e5768e319cc59d8b275b8d2163f3687161aa4226837f7cde1adc373bfcbf5828707a96e18732c8de1f25894fc5e53fdd80cc9746

Download Submit
memory/3644-18-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/3644-17-0x0000000000800000-0x0000000000806000-memory.dmp

Filesize
24KB

Download
memory/4764-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4764-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4764-2-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download