65471b24d57a9574b949d4fc6174f974fb55c9dbab149f0e4accdb8f696c3838

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-03-2024 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-18_8556f1c165f920fad0b6719858d977bb_cryptolocker.exe
Size

53KB
MD5

8556f1c165f920fad0b6719858d977bb
SHA1

4c76bc8c33747af9f13cff3951bd16b19d9f0010
SHA256

65471b24d57a9574b949d4fc6174f974fb55c9dbab149f0e4accdb8f696c3838
SHA512

63a8df237160d0452f8f8672072650887a2cc8b857cf065cd91a3470e55ac2ef5cc40e20290b3ff08c1697875939d31a33f75c7792be0aa1196e9305693d2a85
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjeJQ7pojakl81:V6a+pOtEvwDpjZ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000002325a-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000002325a-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-03-18_8556f1c165f920fad0b6719858d977bb_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4996	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 4996	3992	2024-03-18_8556f1c165f920fad0b6719858d977bb_cryptolocker.exe	102
PID 3992 wrote to memory of 4996	3992	2024-03-18_8556f1c165f920fad0b6719858d977bb_cryptolocker.exe	102
PID 3992 wrote to memory of 4996	3992	2024-03-18_8556f1c165f920fad0b6719858d977bb_cryptolocker.exe	102

C:\Users\Admin\AppData\Local\Temp\2024-03-18_8556f1c165f920fad0b6719858d977bb_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-18_8556f1c165f920fad0b6719858d977bb_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3712 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:64

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
53KB

MD5
52e25e2269599cdc9b9000eb5b49ab78

SHA1
91c750e6bd79087a338acc6bc51208473a0db4d9

SHA256
b5e90cfd17849281d1701308bc22d0a2daaf94e99a7a523dd5e879f19663ddb1

SHA512
5ca17f728958072bc4a3be9d1ae8f87c2ca80ad30a4f38f699093d37f6cc4cde588bbb0996e705f2f2b9fb2df045f91508d6a0829bd6cb6ea50cea7bed3e85ec

Download Submit
memory/3992-0-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/3992-1-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/3992-2-0x0000000000750000-0x0000000000756000-memory.dmp

Filesize
24KB

Download
memory/4996-17-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4996-18-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download