2c89a754ba05129f82bfa9be64bf6d095b54ba3d44fb47d6ff7b60f4d39666e2

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2024 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-08_d855ed5af7248cc44c7bb9c8bd906330_cryptolocker.exe
Size

49KB
MD5

d855ed5af7248cc44c7bb9c8bd906330
SHA1

232ce175dcf44ca3112da4760a9473dbcd6f8b80
SHA256

2c89a754ba05129f82bfa9be64bf6d095b54ba3d44fb47d6ff7b60f4d39666e2
SHA512

660a9d796a50c33bed93f22cfdcd4bbd12156c5ed72e8f9d8e4fc081c0bd9242550ba362626c11283ce9b9e7b31e8f4f6c6f8720112f42757bfbbedf3a46ebbe
SSDEEP

768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05WTB52zZ:qmbhXDmjr5MOtEvwDpj5cDtKkQZQ6uV

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/1000-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x000800000002332f-13.dat	CryptoLocker_rule2
behavioral2/memory/1000-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/1156-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 2 IoCs

resource	yara_rule
behavioral2/memory/1000-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/1156-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/1000-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral2/files/0x000800000002332f-13.dat	UPX
behavioral2/memory/1000-17-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral2/memory/1156-26-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	2024-03-08_d855ed5af7248cc44c7bb9c8bd906330_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1156	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 1156	1000	2024-03-08_d855ed5af7248cc44c7bb9c8bd906330_cryptolocker.exe	98
PID 1000 wrote to memory of 1156	1000	2024-03-08_d855ed5af7248cc44c7bb9c8bd906330_cryptolocker.exe	98
PID 1000 wrote to memory of 1156	1000	2024-03-08_d855ed5af7248cc44c7bb9c8bd906330_cryptolocker.exe	98

C:\Users\Admin\AppData\Local\Temp\2024-03-08_d855ed5af7248cc44c7bb9c8bd906330_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-08_d855ed5af7248cc44c7bb9c8bd906330_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4148 --field-trial-handle=3016,i,1323102786462900035,7687994236215859601,262144 --variations-seed-version /prefetch:8
1⤵
PID:824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
49KB

MD5
60a7636058fe7000091eb629d0824fb1

SHA1
9bc99f661342c2d3e08435a38e3a85252f2dc50b

SHA256
a687f6af33f68842e2d3dd0b39c0262ee430ee6374868b9fc0426a63d2d29849

SHA512
cff17466502737bada69ed61bb4de8c4599270d86fbc201c4e9c382d40b0aa26bc3cc095c432bbdf6ce4f8b69591834329b735626c0810e9d565bebe05cbc296

Download Submit
memory/1000-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1000-1-0x0000000000630000-0x0000000000636000-memory.dmp

Filesize
24KB

Download
memory/1000-2-0x0000000000630000-0x0000000000636000-memory.dmp

Filesize
24KB

Download
memory/1000-3-0x0000000000650000-0x0000000000656000-memory.dmp

Filesize
24KB

Download
memory/1000-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1156-19-0x0000000000530000-0x0000000000536000-memory.dmp

Filesize
24KB

Download
memory/1156-20-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/1156-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download