beff0572deb8d1a914fc15a6f15c5617853e08d48e8e2cf176f148c5c00f1721

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 11:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-19_30e4201f18e926b0e924aa880a72b83b_cryptolocker.exe
Size

87KB
MD5

30e4201f18e926b0e924aa880a72b83b
SHA1

f5dd1802f80076a3b949742d2f3760163796998c
SHA256

beff0572deb8d1a914fc15a6f15c5617853e08d48e8e2cf176f148c5c00f1721
SHA512

e7490b891e840216ce1d90bc296779b95abb97f5a8b7cf5d2580d4802250a45291ba0035fc967870cf7be193b6f0672352a021bd1aff5c178891290b98234bd9
SSDEEP

768:qkmnjFom/kLyMro2GtOOtEvwDpjeY10Y/YMsvlMdwPK80GQuchoIgtIJ/I:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgp

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/2688-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x000400000002271f-13.dat	CryptoLocker_rule2
behavioral2/memory/2688-24-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/3292-25-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral2/memory/2688-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x000400000002271f-13.dat	CryptoLocker_set1
behavioral2/memory/2688-24-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral2/memory/3292-25-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/2688-0-0x0000000000500000-0x000000000050F000-memory.dmp	UPX
behavioral2/files/0x000400000002271f-13.dat	UPX
behavioral2/memory/2688-24-0x0000000000500000-0x000000000050F000-memory.dmp	UPX
behavioral2/memory/3292-25-0x0000000000500000-0x000000000050F000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-03-19_30e4201f18e926b0e924aa880a72b83b_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3292	asih.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2688-0-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/files/0x000400000002271f-13.dat	upx
behavioral2/memory/2688-24-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/memory/3292-25-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 3292	2688	2024-03-19_30e4201f18e926b0e924aa880a72b83b_cryptolocker.exe	98
PID 2688 wrote to memory of 3292	2688	2024-03-19_30e4201f18e926b0e924aa880a72b83b_cryptolocker.exe	98
PID 2688 wrote to memory of 3292	2688	2024-03-19_30e4201f18e926b0e924aa880a72b83b_cryptolocker.exe	98

C:\Users\Admin\AppData\Local\Temp\2024-03-19_30e4201f18e926b0e924aa880a72b83b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-19_30e4201f18e926b0e924aa880a72b83b_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3728 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:4016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
87KB

MD5
6772fa09929bec40132ac375d401f24c

SHA1
061ad175d90d82c39e48b94685673eaadd2d0206

SHA256
ac9406ec3b2e131188ab635d16dd732f32e6bdff2fa4333f8b35e6bf0271d77b

SHA512
f512ad155c08057fae15fd0f38c026fe5c32df49f8cf345dcf26c7b9954e70118eea70897de2664c4875670c0d90c22d420c59fd6f3a2405adc31f2cb222ae34

Download Submit
memory/2688-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2688-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2688-2-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2688-3-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/2688-24-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3292-25-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download