0741a07340e647275019a4c54589cae19d00d81e5fcb57b804c576338e0dc48e

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_699b1fedef6447cb58df4c2db0e99da6_cryptolocker.exe
Size

125KB
MD5

699b1fedef6447cb58df4c2db0e99da6
SHA1

9294956cd62ac2a1d6399311b5ed00d2ccbf2bac
SHA256

0741a07340e647275019a4c54589cae19d00d81e5fcb57b804c576338e0dc48e
SHA512

da12138231475035c16e2e1836ba11c716ffa176cd80065a4682af5d97f76db13865ecf6e3363fe644cb5e32397a319069b0238e8eec349bfc4cfae142773a58
SSDEEP

1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp699GNtL1eo:AnBdOOtEvwDpj6zu

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1268-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral2/memory/3908-19-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/1268-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/3908-27-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1268-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral2/memory/3908-19-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral2/memory/1268-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral2/memory/3908-27-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1268-0-0x0000000000500000-0x000000000050F000-memory.dmp	UPX
C:\Users\Admin\AppData\Local\Temp\asih.exe	UPX
behavioral2/memory/3908-19-0x0000000000500000-0x000000000050F000-memory.dmp	UPX
behavioral2/memory/1268-17-0x0000000000500000-0x000000000050F000-memory.dmp	UPX
behavioral2/memory/3908-27-0x0000000000500000-0x000000000050F000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-02-12_699b1fedef6447cb58df4c2db0e99da6_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	2024-02-12_699b1fedef6447cb58df4c2db0e99da6_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

3908 asih.exe

pid	process
3908	asih.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1268-0-0x0000000000500000-0x000000000050F000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\asih.exe	upx
behavioral2/memory/3908-19-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/memory/1268-17-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/memory/3908-27-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-02-12_699b1fedef6447cb58df4c2db0e99da6_cryptolocker.exe

description	pid	process	target process
PID 1268 wrote to memory of 3908	1268	2024-02-12_699b1fedef6447cb58df4c2db0e99da6_cryptolocker.exe	asih.exe
PID 1268 wrote to memory of 3908	1268	2024-02-12_699b1fedef6447cb58df4c2db0e99da6_cryptolocker.exe	asih.exe
PID 1268 wrote to memory of 3908	1268	2024-02-12_699b1fedef6447cb58df4c2db0e99da6_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-02-12_699b1fedef6447cb58df4c2db0e99da6_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_699b1fedef6447cb58df4c2db0e99da6_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1268

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:3908

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe
Filesize
126KB

MD5
5ee5a124562656f39cbb04109d309712

SHA1
2af5000eea5b0d240b7dcbe92769298a3d9de924

SHA256
86fdbf5f026744486b87dda7f440f295d127ef6ae95ecbcc1cddd145d9dd1c41

SHA512
feac6f740842d7f2bd9ee92b8ed19c9beb14fc11d12d86b098c27d2881e6a61354b27aba96bae8e73eb38001282e0b74b2d18f5a8dd81248a18e78476f191e7d

Download Submit
memory/1268-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1268-1-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download
memory/1268-2-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download
memory/1268-3-0x00000000021B0000-0x00000000021B6000-memory.dmp

Filesize
24KB

Download
memory/1268-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3908-19-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3908-20-0x0000000002100000-0x0000000002106000-memory.dmp

Filesize
24KB

Download
memory/3908-22-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/3908-27-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download