842d3a81ffe317220718a5f16a7028ad4faf20a39132620e6f311a24053bc633

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 06:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-23_0827e14a819cb827747b28645449deef_cryptolocker.exe
Size

74KB
MD5

0827e14a819cb827747b28645449deef
SHA1

9e84114e4165c5116157f204f125344f54f6919c
SHA256

842d3a81ffe317220718a5f16a7028ad4faf20a39132620e6f311a24053bc633
SHA512

e4b32b0e22ef1ee0de2bad04a767614bf3c71a5573b2f379c567327dd31200b4b33e3f834b6497028b713b22602eaa2e6d7674d23433b9b641e73ce35903e91a
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1ss+h:X6a+SOtEvwDpjBZYvQd2A

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002310f-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002310f-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	2024-02-23_0827e14a819cb827747b28645449deef_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
432	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 432	216	2024-02-23_0827e14a819cb827747b28645449deef_cryptolocker.exe	85
PID 216 wrote to memory of 432	216	2024-02-23_0827e14a819cb827747b28645449deef_cryptolocker.exe	85
PID 216 wrote to memory of 432	216	2024-02-23_0827e14a819cb827747b28645449deef_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-02-23_0827e14a819cb827747b28645449deef_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-23_0827e14a819cb827747b28645449deef_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:216
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
74KB

MD5
59eb8bf13cdcb6240d3558f7734466ee

SHA1
814e733a0a387b0e0369426a1120d9caf209c2bc

SHA256
824722af4f078586060d4788dd3d2ec2749a2ecba4ef6396e6ce66b5d4c1a6ba

SHA512
a62758760ef910a390870cce9d3563cd9b263b4105f9989d171dbb31026474a7b4a1eef1c1172eeba1da50f515093c60a883d22fe6a2719ca5e4b0178e587565

Download Submit
memory/216-0-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/216-1-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/216-2-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/432-17-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/432-21-0x00000000020D0000-0x00000000020D6000-memory.dmp

Filesize
24KB

Download