179897cd4c5b9e72f46fadc720f22958e20e8c0aedea454c9417b746b7b13e00

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 01:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-20_e376209fd18b53ad962b922c684b34b6_cryptolocker.exe
Size

94KB
MD5

e376209fd18b53ad962b922c684b34b6
SHA1

024457ef713e273df8a663ebf2c7367780cc0379
SHA256

179897cd4c5b9e72f46fadc720f22958e20e8c0aedea454c9417b746b7b13e00
SHA512

b5df714ef763d301323d9cee7f5553bfe8e7da8c84d3a1589721a52ced5a43c28010edbc9f90fe9ea255e524cc9a04575eabcff1a65aed103e5eed90fcaab89b
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwNgpA:V6a+pOtEvwDpjtzL

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000900000002320b-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000900000002320b-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	2024-02-20_e376209fd18b53ad962b922c684b34b6_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4672	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 4672	4640	2024-02-20_e376209fd18b53ad962b922c684b34b6_cryptolocker.exe	84
PID 4640 wrote to memory of 4672	4640	2024-02-20_e376209fd18b53ad962b922c684b34b6_cryptolocker.exe	84
PID 4640 wrote to memory of 4672	4640	2024-02-20_e376209fd18b53ad962b922c684b34b6_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-20_e376209fd18b53ad962b922c684b34b6_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-20_e376209fd18b53ad962b922c684b34b6_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
94KB

MD5
ac001e57bd4821b0d631137db1c9b0b0

SHA1
ad0d5dfd5c8861d374e25392055c0010a6eb565c

SHA256
25d3064c6fcc64485448660806e4cb4fe437b78144f1f0695688dce2a97f3a09

SHA512
4da5deca9c616c59ae8b7b9752f64dc775e6f56601a4daf7793205a2fde12838d7762c4f7944388b4d24873a900c15cf8ae9cbf9ed1fc2c45f5fd870c6cd00a3

Download Submit
memory/4640-0-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/4640-1-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/4640-2-0x0000000000510000-0x0000000000516000-memory.dmp

Filesize
24KB

Download
memory/4672-17-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/4672-19-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download