5e6aea223c6741a86a42dd3126bf133a79afb33701790559afa0283c47375759

Analysis

max time kernel
150s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 06:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-08_d67ebbdc6bc495aad3f24e28178db240_cryptolocker.exe
Size

68KB
MD5

d67ebbdc6bc495aad3f24e28178db240
SHA1

a43a9cbaf41a306846a8126d31957eb50631503b
SHA256

5e6aea223c6741a86a42dd3126bf133a79afb33701790559afa0283c47375759
SHA512

656b377f25c25334283e157ec4d9c2ef370a77bacad5ce15865266aeb82aba6ce1506e5702005f8225f0b327916b4cd0828d8c678bf9ea9f05be7df21be490d6
SSDEEP

1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKUri:DW60sllyWOtEvwDpjwF85k

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/4276-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x0007000000023273-13.dat	CryptoLocker_rule2
behavioral2/memory/1060-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/4276-26-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral2/memory/4276-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x0007000000023273-13.dat	CryptoLocker_set1
behavioral2/memory/1060-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral2/memory/4276-26-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-03-08_d67ebbdc6bc495aad3f24e28178db240_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1060	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 1060	4276	2024-03-08_d67ebbdc6bc495aad3f24e28178db240_cryptolocker.exe	99
PID 4276 wrote to memory of 1060	4276	2024-03-08_d67ebbdc6bc495aad3f24e28178db240_cryptolocker.exe	99
PID 4276 wrote to memory of 1060	4276	2024-03-08_d67ebbdc6bc495aad3f24e28178db240_cryptolocker.exe	99

C:\Users\Admin\AppData\Local\Temp\2024-03-08_d67ebbdc6bc495aad3f24e28178db240_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-08_d67ebbdc6bc495aad3f24e28178db240_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3580 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
68KB

MD5
33c5857ea62f7bc8a619bd9e28248f7a

SHA1
3f112c7c94bd65a3328b1da3feda514c4e699b76

SHA256
f0249253c205641b2dac39239c6a307530ef8e3b692549e64fe0e9ad7af295a3

SHA512
57bb4d24c304897f138859d77ff81384dbe22bbc483b44d0e28d54bff308608b72f98299582ab9628130b7913b3aac9c9712dcd2c0eea105396d8de5ee409fb8

Download Submit
memory/1060-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1060-19-0x00000000007D0000-0x00000000007D6000-memory.dmp

Filesize
24KB

Download
memory/1060-21-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/4276-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/4276-1-0x0000000000670000-0x0000000000676000-memory.dmp

Filesize
24KB

Download
memory/4276-2-0x0000000000670000-0x0000000000676000-memory.dmp

Filesize
24KB

Download
memory/4276-3-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/4276-26-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download