47c043e7dcc53d08fa7657c1ace7e2a5c5c7af49191f9e202b0598f1ba686bfe

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 05:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-19_19196da9c879d250768a8445978398bc_cryptolocker.exe
Size

70KB
MD5

19196da9c879d250768a8445978398bc
SHA1

da172f977741ed48d1f13bfe16bedf07de65ea67
SHA256

47c043e7dcc53d08fa7657c1ace7e2a5c5c7af49191f9e202b0598f1ba686bfe
SHA512

9459090ccd69d8cbffe13e5690587125457c304300810128bf5f0ee7584532e5f88c7bba3fdd7e30032568994cc8a95122465d603608cc55ddf5b8880e0c25ad
SSDEEP

1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKU1:DW60sllyWOtEvwDpjwF85b

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 3 IoCs

resource	yara_rule
behavioral2/memory/240-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x0009000000023106-13.dat	CryptoLocker_rule2
behavioral2/memory/240-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 3 IoCs

resource	yara_rule
behavioral2/memory/240-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x0009000000023106-13.dat	CryptoLocker_set1
behavioral2/memory/240-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	2024-02-19_19196da9c879d250768a8445978398bc_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1220	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 240 wrote to memory of 1220	240	2024-02-19_19196da9c879d250768a8445978398bc_cryptolocker.exe	88
PID 240 wrote to memory of 1220	240	2024-02-19_19196da9c879d250768a8445978398bc_cryptolocker.exe	88
PID 240 wrote to memory of 1220	240	2024-02-19_19196da9c879d250768a8445978398bc_cryptolocker.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-02-19_19196da9c879d250768a8445978398bc_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-19_19196da9c879d250768a8445978398bc_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:240
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
70KB

MD5
3cc91a8b5e7d27e3659f5ba43b41bfb5

SHA1
75c5f981726751b1988045f31214c9e3dff636f7

SHA256
de4f59db0113f0c93ef3a7060e94e11e66a1b9c1b10831c27e37dcdd61e65d2b

SHA512
4d1713f876eb3707b2c95a56465505733f478a161375d1b7927efbed40752fc3ea8dcaa956d03665da655d825a88e4f40ebc5c3aea34093da4ccf0c514996931

Download Submit
memory/240-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/240-1-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/240-2-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/240-3-0x0000000002100000-0x0000000002106000-memory.dmp

Filesize
24KB

Download
memory/240-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1220-19-0x0000000000820000-0x0000000000826000-memory.dmp

Filesize
24KB

Download
memory/1220-21-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download