e2aaf39f1910b4ca549808621d423064326cbf985e5a53c41a7a894e630d1b8f

Analysis

max time kernel
147s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 06:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-19_d4065a3c3685cdff10c5fa3efa3e485c_cryptolocker.exe
Size

91KB
MD5

d4065a3c3685cdff10c5fa3efa3e485c
SHA1

e8d15ac6c652b7ecd743fce06a994a4d90e6a595
SHA256

e2aaf39f1910b4ca549808621d423064326cbf985e5a53c41a7a894e630d1b8f
SHA512

48a56c048b22a676f050592ff7736e4925f3c198185405c1ac0517ae6ee7fcf476760a4955d1e2546db9262421ceb755005808e7ca7938e7c94ec3c446ea05e6
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwMgL:V6a+pOtEvwDpjtzn

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00050000000224ff-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x00050000000224ff-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	2024-03-19_d4065a3c3685cdff10c5fa3efa3e485c_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3180	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 3180	116	2024-03-19_d4065a3c3685cdff10c5fa3efa3e485c_cryptolocker.exe	87
PID 116 wrote to memory of 3180	116	2024-03-19_d4065a3c3685cdff10c5fa3efa3e485c_cryptolocker.exe	87
PID 116 wrote to memory of 3180	116	2024-03-19_d4065a3c3685cdff10c5fa3efa3e485c_cryptolocker.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-03-19_d4065a3c3685cdff10c5fa3efa3e485c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-19_d4065a3c3685cdff10c5fa3efa3e485c_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:116
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
91KB

MD5
f734c3935f0a2f59d7933ecf6f535ba7

SHA1
925cbbcfa593e33f68b128454bc186f7f180195b

SHA256
15d63d721213e8d2737c9e04eacfed8505dbabb171f5b9997870de11825ef1d5

SHA512
d86e333c2659144ead679545377470c3ae49e0418b2a60dbd883074b89d5644b050b82cbfcc79edc7ee09c5e74c60f13bb65a04a1fc543e700dff8b0b46bb7cb

Download Submit
memory/116-0-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download
memory/116-1-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download
memory/116-2-0x0000000000650000-0x0000000000656000-memory.dmp

Filesize
24KB

Download
memory/3180-17-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/3180-18-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download