816b4f5dcc3e73624909d1349c482e83e297b72f8c7659c46a2ef279b22d80c3

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 17:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_e8b921cd3e6d6e2fbd48e147273e995a_cryptolocker.exe
Size

43KB
MD5

e8b921cd3e6d6e2fbd48e147273e995a
SHA1

4394461a8599bc4a27d0befe369bcf684caf37dc
SHA256

816b4f5dcc3e73624909d1349c482e83e297b72f8c7659c46a2ef279b22d80c3
SHA512

2f51100b18e3233b0ad0f54a566f0d07cab1c836b172718e82af902fa7b79128b59d2aebeb9b132cdf2b23d432dc3614fc2194a24954a3aef0aa554cd59cd75a
SSDEEP

768:79inqyNR/QtOOtEvwDpjBKccJVODvccwX:79mqyNhQMOtEvwDpjBzck1o

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1948-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral2/memory/1948-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1948-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral2/memory/1948-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-02-12_e8b921cd3e6d6e2fbd48e147273e995a_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	2024-02-12_e8b921cd3e6d6e2fbd48e147273e995a_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

3284 asih.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3284	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-02-12_e8b921cd3e6d6e2fbd48e147273e995a_cryptolocker.exe

description	pid	process	target process
PID 1948 wrote to memory of 3284	1948	2024-02-12_e8b921cd3e6d6e2fbd48e147273e995a_cryptolocker.exe	asih.exe
PID 1948 wrote to memory of 3284	1948	2024-02-12_e8b921cd3e6d6e2fbd48e147273e995a_cryptolocker.exe	asih.exe
PID 1948 wrote to memory of 3284	1948	2024-02-12_e8b921cd3e6d6e2fbd48e147273e995a_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-02-12_e8b921cd3e6d6e2fbd48e147273e995a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_e8b921cd3e6d6e2fbd48e147273e995a_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1948

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:3284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
43KB

MD5
90191be8413dda92be3216290b736375

SHA1
c47b7a721806429c8c050a0ac72fd05e5375e964

SHA256
1b6049622ea881576556a45b886a70590d69fe9552711d555434ad712aa2c76e

SHA512
53202d0d460e565374d12cc08b9385b6e437f934d500f185956b82b9d2b0e99ba4280a54ee9aad2723507cd904dc502b64babf6e6ca2b72807e5d73aab5be37c

Download Submit
memory/1948-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1948-1-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/1948-2-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/1948-3-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/1948-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3284-19-0x0000000000760000-0x0000000000766000-memory.dmp

Filesize
24KB

Download
memory/3284-21-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download