8a8d9e8cf949f59f9fac45bf5e38b801018a91a0b6bcaa88244729ce0388d538

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 16:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-14_0519fb694d6b678ce341ee14111c6629_cryptolocker.exe
Size

48KB
MD5

0519fb694d6b678ce341ee14111c6629
SHA1

242c415aa840e8889d9d8c09ec0b0c566eb2d967
SHA256

8a8d9e8cf949f59f9fac45bf5e38b801018a91a0b6bcaa88244729ce0388d538
SHA512

c59d93d4c905753a3f84a1425c1d0f7c547516deb8e3f65deb3a272fb580ce702a7e07e3a0346799bbf3a6bc87ecc2f29449a82d0365f2e239ebc8654e775164
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaaEqbIu55id3AMWZq9S:X6QFElP6n+gJQMOtEvwDpjB0GIWiWLcS

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231f0-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231f0-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	2024-02-14_0519fb694d6b678ce341ee14111c6629_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3144	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 3144	4464	2024-02-14_0519fb694d6b678ce341ee14111c6629_cryptolocker.exe	84
PID 4464 wrote to memory of 3144	4464	2024-02-14_0519fb694d6b678ce341ee14111c6629_cryptolocker.exe	84
PID 4464 wrote to memory of 3144	4464	2024-02-14_0519fb694d6b678ce341ee14111c6629_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-14_0519fb694d6b678ce341ee14111c6629_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-14_0519fb694d6b678ce341ee14111c6629_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
48KB

MD5
8b77ef339f1d85e00e48855b253accb8

SHA1
10c39829bf97bf0eb429b37dc93175515e8c4906

SHA256
697b0ccb6d1b9e4f31b589488a0d28c06e2424473db190a2cfdc650d4539b6cb

SHA512
e3a844f73dc7925e9a451e3f200e016c5d98b45dcc76331026b112bbe51832fd63d24065965b655c0dd426b661b9db44a662ac6c219da7684398981c1e4d8346

Download Submit
memory/3144-17-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/3144-23-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/4464-0-0x0000000002220000-0x0000000002226000-memory.dmp

Filesize
24KB

Download
memory/4464-1-0x0000000002220000-0x0000000002226000-memory.dmp

Filesize
24KB

Download
memory/4464-2-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download