08ad67c3d5ebb9053091525202174f1a08d256345e0223129b20d2c6857c7eba

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-28_bd714e4cdc618ea3aa54c1f5895610e2_cryptolocker.exe
Size

50KB
MD5

bd714e4cdc618ea3aa54c1f5895610e2
SHA1

23d4894733cfefc583bbb0e0fb96094db93ad368
SHA256

08ad67c3d5ebb9053091525202174f1a08d256345e0223129b20d2c6857c7eba
SHA512

f5fda78424490c9811dbedcf2eed5909c4bd2a71767dd53a4d27030229080f28633f507f4bca5534f03a8a2c8958aa0ebc78aa58acd66a59641b47e1d73d0d8d
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjeJQ7pojakNe:V6a+pOtEvwDpj9

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000022745-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000022745-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	2024-02-28_bd714e4cdc618ea3aa54c1f5895610e2_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1636	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 1636	1816	2024-02-28_bd714e4cdc618ea3aa54c1f5895610e2_cryptolocker.exe	91
PID 1816 wrote to memory of 1636	1816	2024-02-28_bd714e4cdc618ea3aa54c1f5895610e2_cryptolocker.exe	91
PID 1816 wrote to memory of 1636	1816	2024-02-28_bd714e4cdc618ea3aa54c1f5895610e2_cryptolocker.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-02-28_bd714e4cdc618ea3aa54c1f5895610e2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-28_bd714e4cdc618ea3aa54c1f5895610e2_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
50KB

MD5
71ce06a82abb7a18c5c338d95f15330f

SHA1
1a76c8f9a81390f56b02db9046248d12cdbb9a12

SHA256
5da49b89035fb95877c7756860d115a6f3caf8e7a107cb211878c35a6c84cc69

SHA512
5da8dc5a9ba988aa538a6b238cf54064ddb4977a41a625b1ec2f035064485adea4d671934abc0a98c390cda25afc5e2a601f92141a321231ab03505b2300757c

Download Submit
memory/1636-17-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/1636-19-0x0000000002150000-0x0000000002156000-memory.dmp

Filesize
24KB

Download
memory/1816-0-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/1816-1-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/1816-2-0x0000000000760000-0x0000000000766000-memory.dmp

Filesize
24KB

Download