26d1b36e7f87a10df46c67a40393d70406911388a5feb24ad5754a9a8b94623c

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-14_c9ecab65f3c319ed056f4dcdd79e7827_cryptolocker.exe
Size

74KB
MD5

c9ecab65f3c319ed056f4dcdd79e7827
SHA1

89d1c0a3e4e0ce71ef0a15ccbf591b9ae5f3b3ba
SHA256

26d1b36e7f87a10df46c67a40393d70406911388a5feb24ad5754a9a8b94623c
SHA512

fa1e52e12ae81cf26253d43d06ab91673c16b9e2c9e257e15172e7780b4cc7213f403594f3735f9985f58444789b783867b87ef3a490b450f92961ddb5a4e2e4
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1siMOl:X6a+SOtEvwDpjBZYvQd2L

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0010000000023155-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x0010000000023155-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	2024-02-14_c9ecab65f3c319ed056f4dcdd79e7827_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
384	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 384	3924	2024-02-14_c9ecab65f3c319ed056f4dcdd79e7827_cryptolocker.exe	85
PID 3924 wrote to memory of 384	3924	2024-02-14_c9ecab65f3c319ed056f4dcdd79e7827_cryptolocker.exe	85
PID 3924 wrote to memory of 384	3924	2024-02-14_c9ecab65f3c319ed056f4dcdd79e7827_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-02-14_c9ecab65f3c319ed056f4dcdd79e7827_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-14_c9ecab65f3c319ed056f4dcdd79e7827_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
74KB

MD5
eb79d9c48e218bed66db4e3669f80312

SHA1
ae80fcf9cc29a8653f77a7c2185570f15f5e6c11

SHA256
712e8a1fc5e25b5a0678c47eff1683d1b8a0ec181b3077bc6c4252d705a1959a

SHA512
c00b1436a229a4a87e1123656ad4016f58afb7a87c0c83d33dca1c007e0536d49d65f12bc8a19467ccea541f6f2c06544228883489a2a9074bdd455fa3479228

Download Submit
memory/384-17-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/384-19-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/3924-0-0x00000000006F0000-0x00000000006F6000-memory.dmp

Filesize
24KB

Download
memory/3924-1-0x00000000006F0000-0x00000000006F6000-memory.dmp

Filesize
24KB

Download
memory/3924-2-0x00000000021B0000-0x00000000021B6000-memory.dmp

Filesize
24KB

Download