f4f5159179dbbf2a5333fe3cd785c276dfd6ba3349dd94c38cbe900d8c5085f1

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-23_f360f8dbec8f46ccbd57245e98d47a31_cryptolocker.exe
Size

84KB
MD5

f360f8dbec8f46ccbd57245e98d47a31
SHA1

6b9379c47c71b1c27272dea323b0a212e5976d73
SHA256

f4f5159179dbbf2a5333fe3cd785c276dfd6ba3349dd94c38cbe900d8c5085f1
SHA512

92bc1e42aed59dde908d78c309284a5c983273a16fe00e50212481460a78db89d3e551170ac24b29056241156d63229bdc55bb775802797947a61d2d3893325e
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjyaLccVNlVSL8v:V6a+pOtEvwDpjvpJ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001e597-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001e597-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000\Control Panel\International\Geo\Nation	2024-02-23_f360f8dbec8f46ccbd57245e98d47a31_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
432	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 432	4568	2024-02-23_f360f8dbec8f46ccbd57245e98d47a31_cryptolocker.exe	88
PID 4568 wrote to memory of 432	4568	2024-02-23_f360f8dbec8f46ccbd57245e98d47a31_cryptolocker.exe	88
PID 4568 wrote to memory of 432	4568	2024-02-23_f360f8dbec8f46ccbd57245e98d47a31_cryptolocker.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-02-23_f360f8dbec8f46ccbd57245e98d47a31_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-23_f360f8dbec8f46ccbd57245e98d47a31_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
85KB

MD5
92b9d47701d5b1cfa60f3e0922f40a4b

SHA1
e8fa7b1e40195f9ff790b1d6ee37f25675be70a6

SHA256
be5db739cad8a99320d49d550784476e0712a7c965ac577ef4d8e55a3891ef8e

SHA512
a7e4725215e89107c31278f00d326fb532fd4c8baf5bc29420c9568e87a0360bfad609878d707a8410dc097a3e858f27f8e5c48fe77a2964f679ad012f8cd59b

Download Submit
memory/432-17-0x00000000020E0000-0x00000000020E6000-memory.dmp

Filesize
24KB

Download
memory/432-19-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/4568-0-0x00000000021C0000-0x00000000021C6000-memory.dmp

Filesize
24KB

Download
memory/4568-1-0x00000000021C0000-0x00000000021C6000-memory.dmp

Filesize
24KB

Download
memory/4568-2-0x0000000002060000-0x0000000002066000-memory.dmp

Filesize
24KB

Download