6e9e51873559b67d7e766a4f2f2ed474b770052e9ea0b0ef72851c0ddca41b84

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 00:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-25_62eeca4822178fed9acdd45e25e8ed15_cryptolocker.exe
Size

107KB
MD5

62eeca4822178fed9acdd45e25e8ed15
SHA1

6a8fe53da7389254687f4ed52c84a47837537bca
SHA256

6e9e51873559b67d7e766a4f2f2ed474b770052e9ea0b0ef72851c0ddca41b84
SHA512

2a78ab8670b353fe2e6170c8c47cbfb441699a1294564de9d0467513072bed8bbcf2eaabf1f95304bc003370e2ff3d8c82ca8ee5cba0dfc56a23df7eeb0c25ce
SSDEEP

1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalRn5iF1j6GkszfF:1nK6a+qdOOtEvwDpjB

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral2/memory/2188-0-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x000a000000023243-13.dat	CryptoLocker_rule2
behavioral2/memory/3436-17-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2188-26-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
behavioral2/memory/3436-27-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral2/memory/2188-0-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
behavioral2/files/0x000a000000023243-13.dat	CryptoLocker_set1
behavioral2/memory/3436-17-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
behavioral2/memory/2188-26-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
behavioral2/memory/3436-27-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral2/memory/2188-0-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
behavioral2/files/0x000a000000023243-13.dat	UPX
behavioral2/memory/3436-17-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
behavioral2/memory/2188-26-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
behavioral2/memory/3436-27-0x0000000000500000-0x000000000050F311-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation	2024-02-25_62eeca4822178fed9acdd45e25e8ed15_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3436	asih.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2188-0-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral2/files/0x000a000000023243-13.dat	upx
behavioral2/memory/3436-17-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral2/memory/2188-26-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral2/memory/3436-27-0x0000000000500000-0x000000000050F311-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 3436	2188	2024-02-25_62eeca4822178fed9acdd45e25e8ed15_cryptolocker.exe	86
PID 2188 wrote to memory of 3436	2188	2024-02-25_62eeca4822178fed9acdd45e25e8ed15_cryptolocker.exe	86
PID 2188 wrote to memory of 3436	2188	2024-02-25_62eeca4822178fed9acdd45e25e8ed15_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-02-25_62eeca4822178fed9acdd45e25e8ed15_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-25_62eeca4822178fed9acdd45e25e8ed15_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
107KB

MD5
a15cd61b5948b97017c1a643df8355ec

SHA1
478876863bc54d19d06ead2992248d9e7d4ed8b0

SHA256
f18af34beda987f3a0384b7a707497093cd567d65adba08e774aefa33280c303

SHA512
c2484f8b4d8fa7839c6a1e5b27a0b07e9defa26e572640d75ebd8a46acc32f211fdc3ee1710379ba85341d509f1d65c67bad4649092a579e89d9466e5fc11acb

Download Submit
memory/2188-0-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2188-1-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/2188-2-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/2188-3-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/2188-26-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/3436-17-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/3436-21-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/3436-27-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download