Analysis

  • max time kernel
    141s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/02/2024, 01:28

General

  • Target

    2024-02-20_27f1144b13052c411fb61cc970376c3b_cryptolocker.exe

  • Size

    41KB

  • MD5

    27f1144b13052c411fb61cc970376c3b

  • SHA1

    cd54c365c4c15a7caeb47bff8b020beea1729d4c

  • SHA256

    7f26de07176f6ab04a45252cc78849ed641dc15c91078fda7b00768b701262d8

  • SHA512

    bd961db74afce5e7adf07584c845b1f0aa772a84d7b6370fed96306f969985739efff65e6d37d789d9977488854c791004e1578848d8690a85075e8e7079c7cd

  • SSDEEP

    384:e/4wODQkzonAYsju5N/surDQtOOtEvwDpjqIGROqS/Wcz0BVFHxzV:79inqyNR/QtOOtEvwDpjBKcmfxB

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 3 IoCs
  • Detection of Cryptolocker Samples 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-20_27f1144b13052c411fb61cc970376c3b_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-20_27f1144b13052c411fb61cc970376c3b_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2968
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:1824

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    41KB

    MD5

    8151b3e3a1c9c1918e54d17b02081fa7

    SHA1

    e8bcb25f41f3ddbec64db7f9c5e0400cd5e58840

    SHA256

    5e9d87fb6f259f0a8469130c7cdd7648c33ef4810f5fbfde1c47092ad4ae9ee0

    SHA512

    64b0c46faad794ac434737fb66f7304f632c73ba4fc7ec42c2803c632d20a18276d0bee2cfc950f51ac7a5e4a61bdc9398efbb35c452c90534b65b5aaa9a05da

  • memory/1824-19-0x00000000006C0000-0x00000000006C6000-memory.dmp

    Filesize

    24KB

  • memory/1824-22-0x00000000006A0000-0x00000000006A6000-memory.dmp

    Filesize

    24KB

  • memory/2968-0-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2968-1-0x0000000002210000-0x0000000002216000-memory.dmp

    Filesize

    24KB

  • memory/2968-2-0x0000000002210000-0x0000000002216000-memory.dmp

    Filesize

    24KB

  • memory/2968-3-0x0000000002230000-0x0000000002236000-memory.dmp

    Filesize

    24KB

  • memory/2968-17-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB