c8767eba1a9f12feb70e86d4aa9b854589d0607b2c95ddf42a7ed2c977702b9e

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
17-02-2024 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-17_a18d8b9238792a90c5ce29d5c9dff0bf_cryptolocker.exe
Size

97KB
MD5

a18d8b9238792a90c5ce29d5c9dff0bf
SHA1

ea4286e46c777c1cd684b3b2a25bd8d72388fd78
SHA256

c8767eba1a9f12feb70e86d4aa9b854589d0607b2c95ddf42a7ed2c977702b9e
SHA512

b1ad342ae307876b9d2c75cfe366df8ecb8b4fc87a549cd4fc95f29cf67b5b4c5c5187b7709d210461fe204126a40fa22e56ff8c1e64206b508e6534c2861440
SSDEEP

1536:26QFElP6n+gBQMOtEvwDpjQGYQbN/PKwNCJg:26a+2OtEvwDpjtzV

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00080000000231f7-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x00080000000231f7-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	2024-02-17_a18d8b9238792a90c5ce29d5c9dff0bf_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
976	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 976	1268	2024-02-17_a18d8b9238792a90c5ce29d5c9dff0bf_cryptolocker.exe	85
PID 1268 wrote to memory of 976	1268	2024-02-17_a18d8b9238792a90c5ce29d5c9dff0bf_cryptolocker.exe	85
PID 1268 wrote to memory of 976	1268	2024-02-17_a18d8b9238792a90c5ce29d5c9dff0bf_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-02-17_a18d8b9238792a90c5ce29d5c9dff0bf_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-17_a18d8b9238792a90c5ce29d5c9dff0bf_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
97KB

MD5
dc05c54e13de6d475868d1ae467c16ac

SHA1
5ddb459a4ef85fc4007535d8d5c34eecc83743af

SHA256
3e46873ef80c8e0a1bc588769c0b00b39d15fcbef4e041fd4a143f5adda42f68

SHA512
df9fb3b40cf51bf0da4191593d38b718be95bda9a0b2bbc8dab47488dbd39530953a16298226abd32d99bb9393acdbded510d20d6a43d73cd8ebbf654c9d455f

Download Submit
memory/976-17-0x00000000006E0000-0x00000000006E6000-memory.dmp

Filesize
24KB

Download
memory/976-20-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/1268-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/1268-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/1268-2-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download