7675ac27c8bb7ff016a734210c004ff040183704179d954679faa3721ac75105

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
17/02/2024, 23:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-17_d1abcd90da09ab6cd0af47bbd22d5675_cryptolocker.exe
Size

44KB
MD5

d1abcd90da09ab6cd0af47bbd22d5675
SHA1

67c6650776f408243a1c172c641039a3eeb25ff7
SHA256

7675ac27c8bb7ff016a734210c004ff040183704179d954679faa3721ac75105
SHA512

0d6933c6620d28c2a47ee01dea8c7abbd8b3c2a4c9bda441a1a6c12e9d487643cf85c46b0335a9d8e613b9327c15f4243df62feff86a525753488a3dc0f1cd5a
SSDEEP

768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6j4AYsqSh+DETkedm+YUS5I7xt:YGzl5wjRQBBOsP1QMOtEvwDpjl39+D+P

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 3 IoCs

resource	yara_rule
behavioral2/memory/2028-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x000700000002320a-13.dat	CryptoLocker_rule2
behavioral2/memory/2028-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 3 IoCs

resource	yara_rule
behavioral2/memory/2028-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x000700000002320a-13.dat	CryptoLocker_set1
behavioral2/memory/2028-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	2024-02-17_d1abcd90da09ab6cd0af47bbd22d5675_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4724	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 4724	2028	2024-02-17_d1abcd90da09ab6cd0af47bbd22d5675_cryptolocker.exe	84
PID 2028 wrote to memory of 4724	2028	2024-02-17_d1abcd90da09ab6cd0af47bbd22d5675_cryptolocker.exe	84
PID 2028 wrote to memory of 4724	2028	2024-02-17_d1abcd90da09ab6cd0af47bbd22d5675_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-17_d1abcd90da09ab6cd0af47bbd22d5675_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-17_d1abcd90da09ab6cd0af47bbd22d5675_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
44KB

MD5
44f5f54417aa97b4146c502a9b766460

SHA1
6fa06ae526fd79c47b7ee68cb488749928bd95a4

SHA256
e76108bb9c51dd1698ff7dbe99b86a93b6d0cd2e4f60f34382b322edd72e89d9

SHA512
49476be5be1a6a1d8556e504ebc77545a849741f11e8bc25e96611c93bcfff45f670815f6aac936199fa951e89f7c0e85900d62fcc301e06c075472ed9749f7c

Download Submit
memory/2028-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2028-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2028-2-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2028-3-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/2028-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/4724-19-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/4724-20-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download