dd0a0d678ec73db1b0aef7f0bcc11ff8265434ef0a9f6d6b2c5f3433fa338874

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 06:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-06_2f06ca826edfed1e884ba74b8f0f789a_cryptolocker.exe
Size

115KB
MD5

2f06ca826edfed1e884ba74b8f0f789a
SHA1

abba6f028d2edf89cdbd01eb9186143c6bae3bb9
SHA256

dd0a0d678ec73db1b0aef7f0bcc11ff8265434ef0a9f6d6b2c5f3433fa338874
SHA512

a141d76a0e0a7c2cc12877233614e60a76fbc017c638ef86e1c563c6e77152f08f2707c25a7f28a87addbbd68f95ac1d71ab15282285f4e47f3894e773b82cfb
SSDEEP

1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwNgp0QVOg:z6a+CdOOtEvwDpjczs

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/316-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x000400000001e5eb-13.dat	CryptoLocker_rule2
behavioral2/memory/316-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2292-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral2/memory/316-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x000400000001e5eb-13.dat	CryptoLocker_set1
behavioral2/memory/316-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/2292-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/316-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral2/files/0x000400000001e5eb-13.dat	UPX
behavioral2/memory/316-17-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral2/memory/2292-26-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	2024-03-06_2f06ca826edfed1e884ba74b8f0f789a_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2292	asih.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/316-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x000400000001e5eb-13.dat	upx
behavioral2/memory/316-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/2292-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 2292	316	2024-03-06_2f06ca826edfed1e884ba74b8f0f789a_cryptolocker.exe	87
PID 316 wrote to memory of 2292	316	2024-03-06_2f06ca826edfed1e884ba74b8f0f789a_cryptolocker.exe	87
PID 316 wrote to memory of 2292	316	2024-03-06_2f06ca826edfed1e884ba74b8f0f789a_cryptolocker.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-03-06_2f06ca826edfed1e884ba74b8f0f789a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-06_2f06ca826edfed1e884ba74b8f0f789a_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:316
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
115KB

MD5
70abf7c9f6316b28bf173544938c616e

SHA1
59db914a7db4e0b12afa5f809276ceb276582162

SHA256
96e05632ebe150ca4d083d57ae5df8422115a51ba7c50314a216296412bdf13c

SHA512
7c71d454bb8771e84cce8df59321932c598100d9196d655fbf48bf77aa1442af3471bb713481bf58dd1779ba32d7ac73169b2d81c06c8914778a9a8383c3ae18

Download Submit
memory/316-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/316-1-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/316-2-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/316-3-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/316-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2292-19-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/2292-23-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/2292-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download