d0cea6a5b39c0807a2ff7170bec89c860127796728e206bbad5db5c31322f3e1

Analysis

max time kernel
167s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 04:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-24_0b0021ad25d3e63f976313fd24efe115_cryptolocker.exe
Size

38KB
MD5

0b0021ad25d3e63f976313fd24efe115
SHA1

30fcd8cfb8a5174167d01fba1f96306d48ece1dc
SHA256

d0cea6a5b39c0807a2ff7170bec89c860127796728e206bbad5db5c31322f3e1
SHA512

b52615f702da3f1ed10877d82d238ec2630784f84c7c1be68ad121bfdf4945341a4420881d39022954b548976caac74b97ed68bd50fb8d1d6e89fe31fd9f936e
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaac4HK/wST:X6QFElP6n+gJQMOtEvwDpjBsYK/T

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00060000000231fb-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x00060000000231fb-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\Control Panel\International\Geo\Nation	2024-02-24_0b0021ad25d3e63f976313fd24efe115_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3252	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 3252	1632	2024-02-24_0b0021ad25d3e63f976313fd24efe115_cryptolocker.exe	92
PID 1632 wrote to memory of 3252	1632	2024-02-24_0b0021ad25d3e63f976313fd24efe115_cryptolocker.exe	92
PID 1632 wrote to memory of 3252	1632	2024-02-24_0b0021ad25d3e63f976313fd24efe115_cryptolocker.exe	92

C:\Users\Admin\AppData\Local\Temp\2024-02-24_0b0021ad25d3e63f976313fd24efe115_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-24_0b0021ad25d3e63f976313fd24efe115_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
39KB

MD5
cade9e010f9b035d28ea3f2822b5778a

SHA1
5dca143b22cef24c49e6c73267f8846dab7207c9

SHA256
1b7216b7d147caf8ba5933338a2e12a0c6379494a3ca3141abe02798c304b667

SHA512
ba90fcdff8ff3c41b497893b28a4e6a4faa1580c7f51768e8458722bc544c36f8f65a4f7abd401e0d79d66d2c74a1c1264bf4ba5e47d2c82514422dbf8f4aa36

Download Submit
memory/1632-0-0x0000000000870000-0x0000000000876000-memory.dmp

Filesize
24KB

Download
memory/1632-1-0x0000000000870000-0x0000000000876000-memory.dmp

Filesize
24KB

Download
memory/1632-2-0x0000000000890000-0x0000000000896000-memory.dmp

Filesize
24KB

Download
memory/3252-17-0x0000000002060000-0x0000000002066000-memory.dmp

Filesize
24KB

Download
memory/3252-22-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download