277e9752a627b093d47ef5798730f18b79df599022319d5366f65b030cae6c02

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 05:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-10_15547bbd8ac21356aa0feb1d5f0999bc_cryptolocker.exe
Size

74KB
MD5

15547bbd8ac21356aa0feb1d5f0999bc
SHA1

2ad1c9e4ecddb622b726bef7d69185cb18e635ef
SHA256

277e9752a627b093d47ef5798730f18b79df599022319d5366f65b030cae6c02
SHA512

3c4c4206d8d374257790dc75235b79d05df135ac99b8c2e8d933d6cc9591b56b91cbb806e529d6999041f01c383eaa871e2c342ee646062e44da23841d4a57c9
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1sA:X6a+SOtEvwDpjBZYvQd2T

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000f00000002324d-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000f00000002324d-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-03-10_15547bbd8ac21356aa0feb1d5f0999bc_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3756	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 3756	2756	2024-03-10_15547bbd8ac21356aa0feb1d5f0999bc_cryptolocker.exe	98
PID 2756 wrote to memory of 3756	2756	2024-03-10_15547bbd8ac21356aa0feb1d5f0999bc_cryptolocker.exe	98
PID 2756 wrote to memory of 3756	2756	2024-03-10_15547bbd8ac21356aa0feb1d5f0999bc_cryptolocker.exe	98

C:\Users\Admin\AppData\Local\Temp\2024-03-10_15547bbd8ac21356aa0feb1d5f0999bc_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-10_15547bbd8ac21356aa0feb1d5f0999bc_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
75KB

MD5
5824580c2da1459c2f1d40c27649a995

SHA1
b7f2362f98a32e319eeee402ad2f4f641cbe4c31

SHA256
c1b4cb019cc6fb5b41630a93bd7d98e22a0efa0c0079a3162618dab04ca29397

SHA512
e5bf39d9a059dd7a83c8bceef5b5bf0c4a53aeace56a7ab4e018aa42cd1bb005f9b3a0920ac31f25c42278d96ff41731d2ca47ff3fd44a8f3b18e540c4a307c7

Download Submit
memory/2756-0-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/2756-1-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/2756-2-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/3756-17-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/3756-18-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download