1eafbb85c287a7756e96ac29ec501d94a131bebfa834c989f67e7e670017fe84

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
18-02-2024 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-18_8e6753bd4993743119ca910aaf39cb4b_cryptolocker.exe
Size

52KB
MD5

8e6753bd4993743119ca910aaf39cb4b
SHA1

8e97c6d91163cb0566d92a9824bff0acf7f2b245
SHA256

1eafbb85c287a7756e96ac29ec501d94a131bebfa834c989f67e7e670017fe84
SHA512

ce3920bbef1d9a801762689ff57195cf330eebed62694aa339dab846b2b189b00000e3da2f68d428fdc57ab278ca28b277851b3ed3607d6421a29b148f1cc2b5
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjeJQ7pojaklc:V6a+pOtEvwDpjD

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00080000000231f0-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x00080000000231f0-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	2024-02-18_8e6753bd4993743119ca910aaf39cb4b_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2236	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 2236	904	2024-02-18_8e6753bd4993743119ca910aaf39cb4b_cryptolocker.exe	84
PID 904 wrote to memory of 2236	904	2024-02-18_8e6753bd4993743119ca910aaf39cb4b_cryptolocker.exe	84
PID 904 wrote to memory of 2236	904	2024-02-18_8e6753bd4993743119ca910aaf39cb4b_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-18_8e6753bd4993743119ca910aaf39cb4b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-18_8e6753bd4993743119ca910aaf39cb4b_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:904
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
52KB

MD5
482c9e6c68d71f229a2fa880f89b7c91

SHA1
1b32357457b57be844dceca87a53fc65e742ad6d

SHA256
af5ca436f742bcf1989fb8d15ac420a45af8b116ae2fcaa9d16309749b4565c0

SHA512
8b20a563fcd2e2bc577c9a556f35a98b84eee552a8db4d00c583441bb8426e802cbaf6b4c1130201737fe49b0de56906848cd4b7428f2b74d8909b5b0dc1f292

Download Submit
memory/904-0-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/904-1-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/904-2-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/2236-17-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/2236-19-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download