b56f0bde0009cec10ef756a7312bb19e67310e014fe9197174bc37e5101800fe

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-11_30c30ac62a29514d2806c1fcbc4909df_cryptolocker.exe
Size

94KB
MD5

30c30ac62a29514d2806c1fcbc4909df
SHA1

656c652b9821836041a8104edffb0c69061fffe4
SHA256

b56f0bde0009cec10ef756a7312bb19e67310e014fe9197174bc37e5101800fe
SHA512

c46123f06624c9cc8f0e4b92e5356d83ff00218bb6ba534bda631c37c4a5ffaec9f030d295a8d8f76aee2a57e53b8f183b5f91a34ff85741520ffb2cc271e590
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwNgpB:V6a+pOtEvwDpjtzW

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000a00000001e735-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000a00000001e735-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	2024-03-11_30c30ac62a29514d2806c1fcbc4909df_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1684	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 1684	2396	2024-03-11_30c30ac62a29514d2806c1fcbc4909df_cryptolocker.exe	92
PID 2396 wrote to memory of 1684	2396	2024-03-11_30c30ac62a29514d2806c1fcbc4909df_cryptolocker.exe	92
PID 2396 wrote to memory of 1684	2396	2024-03-11_30c30ac62a29514d2806c1fcbc4909df_cryptolocker.exe	92

C:\Users\Admin\AppData\Local\Temp\2024-03-11_30c30ac62a29514d2806c1fcbc4909df_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-11_30c30ac62a29514d2806c1fcbc4909df_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
95KB

MD5
44a2b8038b17617e6b73695526ad223f

SHA1
fd4742da0b22a8e8c3acf0aecc7617f0f2242151

SHA256
66bbee1c1b82588897b6fb292da50c609cc26ffccca71fed0a312958cd14dc52

SHA512
a6dc82748a20538910a9a968315039436d42573b3f13dc8eed4bbc7509ecb5ffd19d3ddf33ffded29447f9a4c9d8eeba567c244ca9c8134f1997f3ee837ceea9

Download Submit
memory/1684-17-0x0000000000640000-0x0000000000646000-memory.dmp

Filesize
24KB

Download
memory/1684-23-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download
memory/2396-0-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/2396-1-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/2396-2-0x0000000002220000-0x0000000002226000-memory.dmp

Filesize
24KB

Download