815bc31dd18fab84b3e899bcbb14b486a2077bd301aceba000cecb14c4258a24

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2024 07:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-20_9edc7374b9e3a7772027ebd66448d8b8_cryptolocker.exe
Size

37KB
MD5

9edc7374b9e3a7772027ebd66448d8b8
SHA1

09ced0886f4d4cad274ddecb2a5a67e37f4afbef
SHA256

815bc31dd18fab84b3e899bcbb14b486a2077bd301aceba000cecb14c4258a24
SHA512

eb8f9bd6dba5a2514f103b56a3de28cb6046c989f5ac860e45653724ded368f2d818b747b109c5417d12797cbe4d30d8904578d3c4b00397fd4ccd5c298880bd
SSDEEP

768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkLpzW4:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkL/

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 3 IoCs

resource	yara_rule
behavioral2/memory/3380-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x00070000000231fc-13.dat	CryptoLocker_rule2
behavioral2/memory/3380-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 3 IoCs

resource	yara_rule
behavioral2/memory/3380-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x00070000000231fc-13.dat	CryptoLocker_set1
behavioral2/memory/3380-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	2024-02-20_9edc7374b9e3a7772027ebd66448d8b8_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2096	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 2096	3380	2024-02-20_9edc7374b9e3a7772027ebd66448d8b8_cryptolocker.exe	83
PID 3380 wrote to memory of 2096	3380	2024-02-20_9edc7374b9e3a7772027ebd66448d8b8_cryptolocker.exe	83
PID 3380 wrote to memory of 2096	3380	2024-02-20_9edc7374b9e3a7772027ebd66448d8b8_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-02-20_9edc7374b9e3a7772027ebd66448d8b8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-20_9edc7374b9e3a7772027ebd66448d8b8_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
37KB

MD5
4eeeddbe1c459fe97fc63355cac04850

SHA1
bde3757d50ab44609758fcbc16c8191448c4ef05

SHA256
aa328afef311b3ea0f136f7e997dd41be0aa63ece60e7a54361fab8d9718d922

SHA512
4f0f3fbe8749f50ddbe50f0c0f1aec012e763ead35df19bf13ff7937fcff23800037855c24da809235aab024cde514da110435e4339d5fe14ffe33081297ee16

Download Submit
memory/2096-19-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/2096-23-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/3380-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/3380-1-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/3380-2-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/3380-3-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/3380-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download