Analysis

  • max time kernel
    158s
  • max time network
    170s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2024, 17:30

General

  • Target

    2024-03-27_3f9c35b2ffd4f3c0bc4b701f2b28c38b_cryptolocker.exe

  • Size

    47KB

  • MD5

    3f9c35b2ffd4f3c0bc4b701f2b28c38b

  • SHA1

    c9378e27a4b470f2c4c953a11f161f6c5712601f

  • SHA256

    8454e45d1ce15cd06e3d8c2d02e0915a28826fbaded695649a30562b44c685a2

  • SHA512

    fd896a5e3331345fd739e2b8d75619beff859da17483790b1eed90858fef12b406c48cc9e60101303d23158aade07deb9cfa673b826fbee8569cad7bbfb6672e

  • SSDEEP

    768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vdXI:X6QFElP6n+gJBMOtEvwDpjBtEdXI

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-27_3f9c35b2ffd4f3c0bc4b701f2b28c38b_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-27_3f9c35b2ffd4f3c0bc4b701f2b28c38b_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:624
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:1596

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    47KB

    MD5

    0b8ea81b7e2bf930c30ce25645f74111

    SHA1

    31766e5bece78e1fd3e2e65e54522ec5423ea90b

    SHA256

    3a7763815828ec970613cf9ee457397859ba9baee26eb2221c979757bbf6bc17

    SHA512

    0ecd0aa30c6a0631977a18662d63498120b5e5c5bfc842754354bc1b4cca02494d041753b7c83666e297cc92a6a209fe15c063322b64868ddffe9cfa02786d5a

  • memory/624-0-0x00000000005E0000-0x00000000005E6000-memory.dmp

    Filesize

    24KB

  • memory/624-1-0x00000000005E0000-0x00000000005E6000-memory.dmp

    Filesize

    24KB

  • memory/624-2-0x0000000000600000-0x0000000000606000-memory.dmp

    Filesize

    24KB

  • memory/1596-17-0x00000000005D0000-0x00000000005D6000-memory.dmp

    Filesize

    24KB

  • memory/1596-21-0x00000000005B0000-0x00000000005B6000-memory.dmp

    Filesize

    24KB