a8f4150007d3d933b3fcade9ec948c456a4719d2c6d7110e18aaf6346e174317

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-20_f7c37f8878239741d4243f50479158cc_cryptolocker.exe
Size

71KB
MD5

f7c37f8878239741d4243f50479158cc
SHA1

8d3b637a19688ee1ca246385a10d072a12feb179
SHA256

a8f4150007d3d933b3fcade9ec948c456a4719d2c6d7110e18aaf6346e174317
SHA512

98ca27ac2c5a4cbb97fe2a16170f9dc98613680d5803b609227fe5c32c33678f22f45d38e178065603c7f7d1bf300cf8a729ebeea579fb12d595bf5b1be14093
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1eSi:X6a+SOtEvwDpjBZYvQd2c

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231e9-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231e9-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	2024-02-20_f7c37f8878239741d4243f50479158cc_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1200	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 1200	5012	2024-02-20_f7c37f8878239741d4243f50479158cc_cryptolocker.exe	84
PID 5012 wrote to memory of 1200	5012	2024-02-20_f7c37f8878239741d4243f50479158cc_cryptolocker.exe	84
PID 5012 wrote to memory of 1200	5012	2024-02-20_f7c37f8878239741d4243f50479158cc_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-20_f7c37f8878239741d4243f50479158cc_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-20_f7c37f8878239741d4243f50479158cc_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
72KB

MD5
a1a6c6c58c31e2a8e0e23948599143f7

SHA1
6a2f9fa471548c13d1ae9d4fb95039eadf14623a

SHA256
1d110a3b6b230ec8efec4e9081cbbeb53aae47cd21571c45acb29bfc70bf93ba

SHA512
a58055850e9c86f239961c9beae70884d718efac41c3fbd38ef2bd0284a9ce04fc7108c34290d87506b1d63fbb0e2f7cb2a74eb6f7d0c95e90a99c05cc301722

Download Submit
memory/1200-17-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/1200-20-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/5012-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/5012-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/5012-2-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download