Analysis

  • max time kernel
    141s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-03-2024 16:41

General

  • Target

    2024-03-19_6a8249c667ea7bd213cc86716e5da79f_cryptolocker.exe

  • Size

    64KB

  • MD5

    6a8249c667ea7bd213cc86716e5da79f

  • SHA1

    99b3896c0117643ec4ebe61a326e306e557aba06

  • SHA256

    f8e8a751176e26728179d7406f37d142fcb4dc3a56e7088c3f723a3fa8c9b5fa

  • SHA512

    66c9e04acdd14f49e5c5e99455af5a40f93a52678685e790c0352177f12d018e50e6dfceac27600f38e21fdf3577b680a30e59908a0bb028afe600e0929d193f

  • SSDEEP

    1536:V6QFElP6n+gMQMOtEvwDpjyaLccVCbmh85f:V6a+pOtEvwDpjvo

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-19_6a8249c667ea7bd213cc86716e5da79f_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-19_6a8249c667ea7bd213cc86716e5da79f_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:5008
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2932
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3772 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3808

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\asih.exe

      Filesize

      64KB

      MD5

      d6f6494ecd089c7923aae3c1bdacd326

      SHA1

      ad9b9bc62e8bc49cdbb956a1e314283fa91349ad

      SHA256

      9bf3d0347500e48112c00829cd00afd0e00fc6dd51e47752e29dbb66a6581cbc

      SHA512

      2db341d261e81b9883d0b85db49ae65394a4b3f8951998bb8e9329f5b0582d32a594dc80be7be00bbd94ef672304020a96f3ac127f5fe651b238977ab4664e5d

    • memory/2932-18-0x0000000002050000-0x0000000002056000-memory.dmp

      Filesize

      24KB

    • memory/2932-17-0x0000000002070000-0x0000000002076000-memory.dmp

      Filesize

      24KB

    • memory/5008-0-0x00000000005A0000-0x00000000005A6000-memory.dmp

      Filesize

      24KB

    • memory/5008-1-0x00000000005A0000-0x00000000005A6000-memory.dmp

      Filesize

      24KB

    • memory/5008-2-0x00000000005D0000-0x00000000005D6000-memory.dmp

      Filesize

      24KB