e7001dd5372c231c2b1c8cb2b50085ad2efa2b4239bcdb5e3d74bdefe7b22494

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 17:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_ea9c3c8227d4286253e2b6d57e25124e_cryptolocker.exe
Size

71KB
MD5

ea9c3c8227d4286253e2b6d57e25124e
SHA1

7fc79ad3f08f2c4b05c5fa187f2ffa34d59f35a5
SHA256

e7001dd5372c231c2b1c8cb2b50085ad2efa2b4239bcdb5e3d74bdefe7b22494
SHA512

715aa15aa92021054ad54ed141331ee0f53b9e944c8b5cd8177d96630027f7ddab559b08900b11fb7d4bc627d4102823615a7b6c13733a31975fc09b69e6a42e
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1D:X6a+SOtEvwDpjBZYvQd2D

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-02-12_ea9c3c8227d4286253e2b6d57e25124e_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	2024-02-12_ea9c3c8227d4286253e2b6d57e25124e_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

4248 asih.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4248	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-02-12_ea9c3c8227d4286253e2b6d57e25124e_cryptolocker.exe

description	pid	process	target process
PID 4504 wrote to memory of 4248	4504	2024-02-12_ea9c3c8227d4286253e2b6d57e25124e_cryptolocker.exe	asih.exe
PID 4504 wrote to memory of 4248	4504	2024-02-12_ea9c3c8227d4286253e2b6d57e25124e_cryptolocker.exe	asih.exe
PID 4504 wrote to memory of 4248	4504	2024-02-12_ea9c3c8227d4286253e2b6d57e25124e_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-02-12_ea9c3c8227d4286253e2b6d57e25124e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_ea9c3c8227d4286253e2b6d57e25124e_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4504

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:4248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
71KB

MD5
478c183fb66885e1cb6caab064defd38

SHA1
d8a52e91c33a00e3587d1483c298a1d78d7db5c5

SHA256
8d91af178c0b19f33b733e790ca5a52a7b0ec04b23b18a37dff7d7be2ab51ad8

SHA512
ad6420412191256c2b432095efa30596c28e80ad26c1ec8409ca26e95a99c283ca45f57bfb862fe2bf3f9183844b39aac693e9c567e262479a7a148483e4a77e

Download Submit
memory/4248-17-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/4248-18-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4504-0-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download
memory/4504-1-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download
memory/4504-2-0x00000000021B0000-0x00000000021B6000-memory.dmp

Filesize
24KB

Download