Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-02-2024 05:29

General

  • Target

    2024-02-12_24e3101e198f61edc4622908ef23715c_cryptolocker.exe

  • Size

    44KB

  • MD5

    24e3101e198f61edc4622908ef23715c

  • SHA1

    2e84596bcbaafb0ac0ce144ec115cb0783b1b37c

  • SHA256

    975f183d250f207e1d7cbded8e376e965aaadde3374a829d946cbaa37d83e896

  • SHA512

    6b46781b95593bc307a6466bff9ab1f2705dd4ddeb633f04463f24ad3f088191afe9cf50f8bd46ce63ef81bbe1e87ee0b8597457ed2e2034a2f5a8469869e601

  • SSDEEP

    768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6j4AYsqSh+DETkedm+My3:YGzl5wjRQBBOsP1QMOtEvwDpjl39+D+j

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 3 IoCs
  • Detection of Cryptolocker Samples 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-12_24e3101e198f61edc4622908ef23715c_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-12_24e3101e198f61edc4622908ef23715c_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4492
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:3688

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    44KB

    MD5

    7cbd0fca0663d158c88a0585853c4320

    SHA1

    0719e1feec7da31029b9bccbea145a8008602622

    SHA256

    f3c28803e002627f3cc2fb2f8efa9450b0ace2f4244371c00c0d889680d29e8c

    SHA512

    674c918033fb57f91bf19085c7681b5809b111339f80b172cacc8dbb3f9d0a8a3add47e22928c7727c1cdcf17c4a3caf5cce7f06c98ad485fa8b5534d952c130

  • memory/3688-19-0x00000000006C0000-0x00000000006C6000-memory.dmp

    Filesize

    24KB

  • memory/3688-21-0x00000000006A0000-0x00000000006A6000-memory.dmp

    Filesize

    24KB

  • memory/4492-0-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/4492-1-0x0000000002220000-0x0000000002226000-memory.dmp

    Filesize

    24KB

  • memory/4492-2-0x0000000002220000-0x0000000002226000-memory.dmp

    Filesize

    24KB

  • memory/4492-3-0x0000000002240000-0x0000000002246000-memory.dmp

    Filesize

    24KB

  • memory/4492-17-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB