00475c757694e5140f6605afd5bb8360c7b1c77c518f3da610e0cf6be08748ab

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-19_578fe1e47a97a7f893259e22627b5f8d_cryptolocker.exe
Size

52KB
MD5

578fe1e47a97a7f893259e22627b5f8d
SHA1

524aae2bf147df46d69a25675f0deeebde0af4d6
SHA256

00475c757694e5140f6605afd5bb8360c7b1c77c518f3da610e0cf6be08748ab
SHA512

aa6f9717c43b5b0473eb626e28fefeda4c17e24d1a33a35b53f0eea9a75cdb57a9e2d8e824090ac77424a6acd25b3e490c6b8b4738fb1a95d65ec87aba508e9e
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjeJQ7pojakl7:V6a+pOtEvwDpj8

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023222-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023222-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	2024-02-19_578fe1e47a97a7f893259e22627b5f8d_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4364	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 4364	4164	2024-02-19_578fe1e47a97a7f893259e22627b5f8d_cryptolocker.exe	83
PID 4164 wrote to memory of 4364	4164	2024-02-19_578fe1e47a97a7f893259e22627b5f8d_cryptolocker.exe	83
PID 4164 wrote to memory of 4364	4164	2024-02-19_578fe1e47a97a7f893259e22627b5f8d_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-02-19_578fe1e47a97a7f893259e22627b5f8d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-19_578fe1e47a97a7f893259e22627b5f8d_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
52KB

MD5
a1620c76a59c9c74daf278bd1d8c8bbf

SHA1
abe6fe2065b58804344a1b6f747200309d256de4

SHA256
76df314a38f80bf186784801fb82d31b402fa2ec68c974a87289f554ec093ffd

SHA512
b2ef80430f73e4d6958ae54eeab8a6631299a2b1213f942e118b2cf9f98c168fe7a4b5418c15520ced5fa7d03246adc59b5d2420adee961ef68ab07a418926fa

Download Submit
memory/4164-0-0x00000000020D0000-0x00000000020D6000-memory.dmp

Filesize
24KB

Download
memory/4164-1-0x00000000020D0000-0x00000000020D6000-memory.dmp

Filesize
24KB

Download
memory/4164-2-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/4364-17-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/4364-20-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download