2e18b31457592d8b4c125bfd9c6b4a1f99b89cc1b41ff7edf056a2afc2860f37

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-10_14a5b436055ee15085979fae7e9f08d1_cryptolocker.exe
Size

92KB
MD5

14a5b436055ee15085979fae7e9f08d1
SHA1

532982f61daca5c5976fae7116b70f9d28006cb7
SHA256

2e18b31457592d8b4c125bfd9c6b4a1f99b89cc1b41ff7edf056a2afc2860f37
SHA512

715bcfe193db10d3518fe80128e7ace920cdb30f0fd9a9ed22d148e4e633cc3bf2b233524aa4a54b860a15fe2f1524acf9c3f63af7afd549bc22603bf395835d
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwMgcf976:V6a+pOtEvwDpjtz1

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000001e59e-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000001e59e-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	2024-03-10_14a5b436055ee15085979fae7e9f08d1_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2828	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 2828	3716	2024-03-10_14a5b436055ee15085979fae7e9f08d1_cryptolocker.exe	90
PID 3716 wrote to memory of 2828	3716	2024-03-10_14a5b436055ee15085979fae7e9f08d1_cryptolocker.exe	90
PID 3716 wrote to memory of 2828	3716	2024-03-10_14a5b436055ee15085979fae7e9f08d1_cryptolocker.exe	90

C:\Users\Admin\AppData\Local\Temp\2024-03-10_14a5b436055ee15085979fae7e9f08d1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-10_14a5b436055ee15085979fae7e9f08d1_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
92KB

MD5
e5beb764739ee2cbb493a05d979bf150

SHA1
dde0f08f3bbbd902f90aa26ea2b1a25ceb33f7cf

SHA256
de071ef490999177b4b11a570e1d205abecf751efdd1e231dd4df1415f4fb91f

SHA512
3850b2f4e5d01fe241282b0742f3ec5ac7a12a8a437aec6a1744b4ac3b24b7a8b98ceaf7660573a4ecfb9c3bff59b2a8cd5febb2671402da0d9d7bb31d528b39

Download Submit
memory/2828-17-0x0000000002100000-0x0000000002106000-memory.dmp

Filesize
24KB

Download
memory/2828-19-0x0000000000630000-0x0000000000636000-memory.dmp

Filesize
24KB

Download
memory/3716-0-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/3716-1-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/3716-2-0x0000000000750000-0x0000000000756000-memory.dmp

Filesize
24KB

Download