f0b4cbc4cceee07c0d3c6d7cb0802a5df67d9e214c4ae70ffd91f26572e38b2a

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-23_7589bbb8cc53c92cf06bb52220b8aa90_cryptolocker.exe
Size

39KB
MD5

7589bbb8cc53c92cf06bb52220b8aa90
SHA1

065e5b21efa39912a04cb8299b986acf067c2c68
SHA256

f0b4cbc4cceee07c0d3c6d7cb0802a5df67d9e214c4ae70ffd91f26572e38b2a
SHA512

97e7244752083b8e3d3b56c4aa10105377d51d45bd4af532423a804757151d8f9707638fcca49b645c789ac05be7dfb01d903342b4cb68ecda10270644cf96d0
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaac4HKcft:X6QFElP6n+gJQMOtEvwDpjBsYK6t

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000230fa-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000230fa-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	2024-02-23_7589bbb8cc53c92cf06bb52220b8aa90_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1720	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 1720	4576	2024-02-23_7589bbb8cc53c92cf06bb52220b8aa90_cryptolocker.exe	86
PID 4576 wrote to memory of 1720	4576	2024-02-23_7589bbb8cc53c92cf06bb52220b8aa90_cryptolocker.exe	86
PID 4576 wrote to memory of 1720	4576	2024-02-23_7589bbb8cc53c92cf06bb52220b8aa90_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-02-23_7589bbb8cc53c92cf06bb52220b8aa90_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-23_7589bbb8cc53c92cf06bb52220b8aa90_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
39KB

MD5
23e98451703dcda987b7296dfefe4d26

SHA1
a713fb7f28d86232b841ce9d7fb516bd2bfe3fa9

SHA256
c9da8cfae8cc1a24efeebfa273b10d6d485a8d82835b70ff807536921c161c24

SHA512
3667f2171140597b462d209ce0939b07aee48fef497bd9c8463d2c9b09335a3824f667c333a60f7132fb9b33d37fe1ef0f0d83020c5119be2c24f0128a9ad7d0

Download Submit
memory/1720-17-0x0000000002100000-0x0000000002106000-memory.dmp

Filesize
24KB

Download
memory/1720-20-0x0000000000840000-0x0000000000846000-memory.dmp

Filesize
24KB

Download
memory/4576-0-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/4576-1-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/4576-2-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download