Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12-02-2024 20:05
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-12_8052f5c219137ede2d6a1d7e64d93247_cryptolocker.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-12_8052f5c219137ede2d6a1d7e64d93247_cryptolocker.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-12_8052f5c219137ede2d6a1d7e64d93247_cryptolocker.exe
-
Size
56KB
-
MD5
8052f5c219137ede2d6a1d7e64d93247
-
SHA1
7c509719c2b2e6c23b767a61897fa40dcb6ce80a
-
SHA256
a19d52b709549e10e691aa504bf0733fa9050ffdb29e0422b4d052117d684575
-
SHA512
918281fd590cbedb93c9a62fef7f1c3c13c42c9268aa809226d2b5bc6d281c7d6a587f591d6ae38b6a776d333743cd9492dd04c106e118c317352c2d14c67b17
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61q:BbdDmjr+OtEvwDpjM4
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3452-0-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 C:\Users\Admin\AppData\Local\Temp\asih.exe CryptoLocker_rule2 behavioral2/memory/3452-17-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral2/memory/2380-26-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3452-17-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 behavioral2/memory/2380-26-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 -
UPX dump on OEP (original entry point) 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3452-0-0x0000000000500000-0x0000000000510000-memory.dmp UPX C:\Users\Admin\AppData\Local\Temp\asih.exe UPX behavioral2/memory/3452-17-0x0000000000500000-0x0000000000510000-memory.dmp UPX behavioral2/memory/2380-26-0x0000000000500000-0x0000000000510000-memory.dmp UPX -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-02-12_8052f5c219137ede2d6a1d7e64d93247_cryptolocker.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation 2024-02-12_8052f5c219137ede2d6a1d7e64d93247_cryptolocker.exe -
Executes dropped EXE 1 IoCs
Processes:
asih.exepid process 2380 asih.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-02-12_8052f5c219137ede2d6a1d7e64d93247_cryptolocker.exedescription pid process target process PID 3452 wrote to memory of 2380 3452 2024-02-12_8052f5c219137ede2d6a1d7e64d93247_cryptolocker.exe asih.exe PID 3452 wrote to memory of 2380 3452 2024-02-12_8052f5c219137ede2d6a1d7e64d93247_cryptolocker.exe asih.exe PID 3452 wrote to memory of 2380 3452 2024-02-12_8052f5c219137ede2d6a1d7e64d93247_cryptolocker.exe asih.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_8052f5c219137ede2d6a1d7e64d93247_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_8052f5c219137ede2d6a1d7e64d93247_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\asih.exeFilesize
56KB
MD5be73eaa5e413c1b2d4ab1dec0dc63fb0
SHA18b17762d2f5aae6cb409045b7c2ad8f29e49ebbe
SHA256503f3421ae24ada63b56a6fea7be469ff3ea5acbc5dae9850d6b9d50860bdbd7
SHA51275d06602c7e036b46fe631dd73659e66cea85673a07c487f113396b031a0211d259fbb1a6833124de096cecfb08fabfdb459e62e03f5a8877848276c00427142
-
memory/2380-19-0x0000000001FF0000-0x0000000001FF6000-memory.dmpFilesize
24KB
-
memory/2380-21-0x0000000000630000-0x0000000000636000-memory.dmpFilesize
24KB
-
memory/2380-26-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/3452-0-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/3452-1-0x0000000000670000-0x0000000000676000-memory.dmpFilesize
24KB
-
memory/3452-3-0x0000000002080000-0x0000000002086000-memory.dmpFilesize
24KB
-
memory/3452-2-0x0000000000670000-0x0000000000676000-memory.dmpFilesize
24KB
-
memory/3452-17-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB