671d84988d9483cd352ef52fe0efb1acfd348ce93790f758628582de1f9c10d3

Analysis

max time kernel
161s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-16_834ffc2c3d3f37411860665cdb2da445_cryptolocker.exe
Size

44KB
MD5

834ffc2c3d3f37411860665cdb2da445
SHA1

11df27c06ba91ebc1cc1a680ab2ed93c2d31396e
SHA256

671d84988d9483cd352ef52fe0efb1acfd348ce93790f758628582de1f9c10d3
SHA512

a315b356866375a9c1f89f84b8217b78b2194b1b2be703af1e93d0ec66e9798348d0bab70a5e0a137b2f43571e939544d09311bba2d0111d118151e5f5df44e2
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLaHaMMm2X3rtJ:V6QFElP6n+gMQMOtEvwDpjyaHaXvJ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000200000001f656-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000200000001f656-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	2024-03-16_834ffc2c3d3f37411860665cdb2da445_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3148	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 3148	1448	2024-03-16_834ffc2c3d3f37411860665cdb2da445_cryptolocker.exe	90
PID 1448 wrote to memory of 3148	1448	2024-03-16_834ffc2c3d3f37411860665cdb2da445_cryptolocker.exe	90
PID 1448 wrote to memory of 3148	1448	2024-03-16_834ffc2c3d3f37411860665cdb2da445_cryptolocker.exe	90

C:\Users\Admin\AppData\Local\Temp\2024-03-16_834ffc2c3d3f37411860665cdb2da445_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-16_834ffc2c3d3f37411860665cdb2da445_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
45KB

MD5
3a396dd8b29d187159fb8a76b9fa0250

SHA1
fbf30efdc3f1cf0fc5001546c082b91c1f76f3b1

SHA256
0e3726bdecc19be5a22f939b6afda4c9c46127aa39754268a6e30f3105abe2e5

SHA512
2377eece40c40fc2f04d3f12927d1ba99af148f962e142df0bef46edb2760e9d8613a5bab2fd70b46942a15540de7fb4c37ef24c67f6121325dea551ecdb1876

Download Submit
memory/1448-0-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/1448-1-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/1448-2-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/3148-19-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download