aebeaa405d41461d292e6e7169d9c915b19951c8837a3f545d0020df4a341bc7

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 08:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-20_3dff8bd8179bc46757912abd0ac3c6ed_cryptolocker.exe
Size

94KB
MD5

3dff8bd8179bc46757912abd0ac3c6ed
SHA1

08fdb6137e51fe1c0e25480e700227129a0ae9cf
SHA256

aebeaa405d41461d292e6e7169d9c915b19951c8837a3f545d0020df4a341bc7
SHA512

7f4f319996332bb8a4b9ece4d3dff4af8c79c18c987734fce9561c2293b17a487d5c45dbcda84ebf09a63b4e3276cd9058c22e072af743681ac386fe9feca66f
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwNuj28EtXJX:V6a+pOtEvwDpjtzz

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002320c-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002320c-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	2024-02-20_3dff8bd8179bc46757912abd0ac3c6ed_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4280	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 4280	4392	2024-02-20_3dff8bd8179bc46757912abd0ac3c6ed_cryptolocker.exe	84
PID 4392 wrote to memory of 4280	4392	2024-02-20_3dff8bd8179bc46757912abd0ac3c6ed_cryptolocker.exe	84
PID 4392 wrote to memory of 4280	4392	2024-02-20_3dff8bd8179bc46757912abd0ac3c6ed_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-20_3dff8bd8179bc46757912abd0ac3c6ed_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-20_3dff8bd8179bc46757912abd0ac3c6ed_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
94KB

MD5
406b9b17a06b572e87648a7ee8da7e17

SHA1
269952cd57fb1374dcc0cf6cdc1354b9fb4f3f8e

SHA256
ece411c06d0edf4a3d47f91f16cd1fab06298f8dafaadf286d0d8abf14c3b004

SHA512
c405e635a4d66a03b6494b469338b9ef747aae5e5996c48d44992aef20aeaf0cdfb438dc1bcdf6cce27b428da3ba384edccda3d934b73317f6ced26fc0bdb0d1

Download Submit
memory/4280-17-0x0000000002100000-0x0000000002106000-memory.dmp

Filesize
24KB

Download
memory/4280-20-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/4392-0-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/4392-1-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/4392-2-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download