534e3d9f644cf8a03af101de9f8bb656fe2eefafd173e2310c1e1a1380c51634

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-03-2024 17:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-09_665ba2accf3a6f790df6a473e7676c64_cryptolocker.exe
Size

135KB
MD5

665ba2accf3a6f790df6a473e7676c64
SHA1

303c2bd71230116061d5bbd89b281abf0e5b1c7d
SHA256

534e3d9f644cf8a03af101de9f8bb656fe2eefafd173e2310c1e1a1380c51634
SHA512

fd8878c1a3bb8d7e11afe936a0abe1080c8b566eadfcadf50342a61bba37738584e8c209d439fe2924c06c69e6f45cf7e1c763e05e5ecd2e8503ad1e0ac6fda1
SSDEEP

1536:u6QFElP6n+gWMOtEvwDpjJGYQbN/PKwNgpwqWsviPeQ:u6a++OtEvwDpj6zB

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000c0000000226fd-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000c0000000226fd-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	2024-03-09_665ba2accf3a6f790df6a473e7676c64_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3788	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 3788	4360	2024-03-09_665ba2accf3a6f790df6a473e7676c64_cryptolocker.exe	90
PID 4360 wrote to memory of 3788	4360	2024-03-09_665ba2accf3a6f790df6a473e7676c64_cryptolocker.exe	90
PID 4360 wrote to memory of 3788	4360	2024-03-09_665ba2accf3a6f790df6a473e7676c64_cryptolocker.exe	90

C:\Users\Admin\AppData\Local\Temp\2024-03-09_665ba2accf3a6f790df6a473e7676c64_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-09_665ba2accf3a6f790df6a473e7676c64_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
135KB

MD5
0bd4924ad5b44d97b38eb85726607977

SHA1
4d3ef07451f0e8f10bd9495c5aa5b03239263e2e

SHA256
2acca92c2924b8a20ffbeed6cb19b975da41a40dd084fdabc6d5f9ecf9686b65

SHA512
c90577d5d2838c69c1647c5576cdf5435cdf62fb7e305db31525decb4f9149a0c8f0f4ce44249419cdef9dc1927bccaee0ef94fa0320dadab3e9f5725116f087

Download Submit
memory/3788-17-0x0000000002000000-0x0000000002006000-memory.dmp

Filesize
24KB

Download
memory/3788-20-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/4360-0-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/4360-1-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/4360-2-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download