Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-02-2024 02:24

General

  • Target

    2024-02-25_073cbff64b3190425e6d6884785545fd_cryptolocker.exe

  • Size

    51KB

  • MD5

    073cbff64b3190425e6d6884785545fd

  • SHA1

    524959a90d1a30bc09921a649da92ca0217e55fc

  • SHA256

    f67bfcef6a8b4f4fdebdabbb4d344b651320ecf96e9beadf9d8765326740703c

  • SHA512

    c3afc7d21526f8321889c0ec08acc3f224f5467b061c5ee74d7cd60ff13cd49358ced00aabda6637369757cded00c4695cf281c6d9a58611a62230b247f43b71

  • SSDEEP

    1536:V6QFElP6n+gMQMOtEvwDpjeJQ7pojaklC:V6a+pOtEvwDpjp

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-25_073cbff64b3190425e6d6884785545fd_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-25_073cbff64b3190425e6d6884785545fd_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4588
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:1224

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    51KB

    MD5

    483eda6671e874aa44b1b945e7f8d3c9

    SHA1

    0b8735de69fef60f94f2cf88bebc27c3007b9645

    SHA256

    d5f86f67f0dbb3df31bbd390fd6203e1a4598df3e21d542b2e34a12075cf1d3f

    SHA512

    f5da5388e2109cc39b287d748c02dab0d889e15edcb4d71b72c74bf35bc12200487f5ab2b1969ad913731ac371b8eec5dc4df150ff02dcbf0d54a2b6744d0975

  • memory/1224-18-0x00000000006C0000-0x00000000006C6000-memory.dmp

    Filesize

    24KB

  • memory/1224-17-0x00000000006A0000-0x00000000006A6000-memory.dmp

    Filesize

    24KB

  • memory/4588-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/4588-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/4588-2-0x00000000004F0000-0x00000000004F6000-memory.dmp

    Filesize

    24KB