5e59a26ae95fb1f6e897c35c0071de0964a79a027f0448ff15ecdf6b49799645

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-14_e4751e0c08f528da6f3a4857fb479b4c_cryptolocker.exe
Size

38KB
MD5

e4751e0c08f528da6f3a4857fb479b4c
SHA1

06df67e50fd2d285d90e8525a8b3157d3dd45cbb
SHA256

5e59a26ae95fb1f6e897c35c0071de0964a79a027f0448ff15ecdf6b49799645
SHA512

2199575731ae22dc3bbcaeed6bad465a8e5f48a129a7243fd95e0f4b9643147dbfac08ecd6bf80b197f51eaaf87ac7280efe671db7f2c1b65d46f4dba3eda642
SSDEEP

768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkLCo:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkLv

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 3 IoCs

resource	yara_rule
behavioral2/memory/2088-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x000700000001e59e-13.dat	CryptoLocker_rule2
behavioral2/memory/2088-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 3 IoCs

resource	yara_rule
behavioral2/memory/2088-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x000700000001e59e-13.dat	CryptoLocker_set1
behavioral2/memory/2088-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	2024-03-14_e4751e0c08f528da6f3a4857fb479b4c_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2616	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2616	2088	2024-03-14_e4751e0c08f528da6f3a4857fb479b4c_cryptolocker.exe	89
PID 2088 wrote to memory of 2616	2088	2024-03-14_e4751e0c08f528da6f3a4857fb479b4c_cryptolocker.exe	89
PID 2088 wrote to memory of 2616	2088	2024-03-14_e4751e0c08f528da6f3a4857fb479b4c_cryptolocker.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-03-14_e4751e0c08f528da6f3a4857fb479b4c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-14_e4751e0c08f528da6f3a4857fb479b4c_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
38KB

MD5
457c75e03ffd81899f7f174ad780aa37

SHA1
efe1fded37ea82fcb734bfe159f273ceee19d90e

SHA256
a5dd7fd7780f1868224a933030ff0e16d1e23054785970286db8de406b105a04

SHA512
08b2d9533644f358e4d7d44796f3171cd7936f72fb01ab3fde6d83d8a8c3aceb9b4195fd2d6c986221a61cdd3a16672155d8d736a1325210860de6e8849e1341

Download Submit
memory/2088-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2088-1-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/2088-2-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/2088-3-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/2088-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2616-19-0x0000000001F70000-0x0000000001F76000-memory.dmp

Filesize
24KB

Download
memory/2616-23-0x0000000001F50000-0x0000000001F56000-memory.dmp

Filesize
24KB

Download