cbcbea8fc69685a6770ccf9e66f7ff14f3c379b55b3acf97755d3ded669fb4ee

Analysis

max time kernel
149s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-15_393909fcf81b97feadad918a2699baf2_cryptolocker.exe
Size

96KB
MD5

393909fcf81b97feadad918a2699baf2
SHA1

56ab0b31cf839850e0c04bf8b8505652a5caa4fb
SHA256

cbcbea8fc69685a6770ccf9e66f7ff14f3c379b55b3acf97755d3ded669fb4ee
SHA512

ecb2f2d5693045502513cd0d0a2e21f05646e1ac6325f8f80ab212a3fdd2cb71d9e91e9f78fc08fe30ed86ca0eac037fadef89f5ea5af2593dcdf0549b442b9c
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwNgp+z:V6a+pOtEvwDpjtz7

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000002321f-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000002321f-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	2024-03-15_393909fcf81b97feadad918a2699baf2_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1564	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 1564	2448	2024-03-15_393909fcf81b97feadad918a2699baf2_cryptolocker.exe	89
PID 2448 wrote to memory of 1564	2448	2024-03-15_393909fcf81b97feadad918a2699baf2_cryptolocker.exe	89
PID 2448 wrote to memory of 1564	2448	2024-03-15_393909fcf81b97feadad918a2699baf2_cryptolocker.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-03-15_393909fcf81b97feadad918a2699baf2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-15_393909fcf81b97feadad918a2699baf2_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
96KB

MD5
defca982453de6a60cae85becaf571c9

SHA1
809a41b53cc2705894f4f47c7aa0183bb863a381

SHA256
0016907491a4f3458782d02f91e8a3185143e9aba2274267b9f6e51167ab65f2

SHA512
eb5ac637bca9cc073177a2b3b86e365cf8eb47f14f76289f9184040a1c76a2322ae73b2a8c3b83430719a167b534b2cedb2e65e61436c8458a556c1fe7dd4733

Download Submit
memory/1564-17-0x00000000007E0000-0x00000000007E6000-memory.dmp

Filesize
24KB

Download
memory/1564-20-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/2448-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2448-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2448-2-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download