fceca2d658bbbe21f33793edf0ff4bc09eb28523e7e1cc40e9a4380d9f2882e4

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-28_b022c6940f73455c1e6e091b472abdfe_cryptolocker.exe
Size

64KB
MD5

b022c6940f73455c1e6e091b472abdfe
SHA1

10e8bc17aacf674310d1a4718e650c6383fd2b44
SHA256

fceca2d658bbbe21f33793edf0ff4bc09eb28523e7e1cc40e9a4380d9f2882e4
SHA512

269d3d3f98a6d5192e3b390ff76589ca91d4fe7e254a5551f5d9f0dae3989f62555d76a89e8a6d9c8c7e08dfed03e6c6fdce648061492eff2ec683f35eaa4469
SSDEEP

1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUa1J:T6a+rdOOtEvwDpjNr

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/2548-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x00090000000224f7-13.dat	CryptoLocker_rule2
behavioral2/memory/2548-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2272-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral2/memory/2548-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x00090000000224f7-13.dat	CryptoLocker_set1
behavioral2/memory/2548-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/2272-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/2548-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral2/files/0x00090000000224f7-13.dat	UPX
behavioral2/memory/2548-17-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral2/memory/2272-25-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	2024-03-28_b022c6940f73455c1e6e091b472abdfe_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2272	asih.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2548-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x00090000000224f7-13.dat	upx
behavioral2/memory/2548-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/2272-25-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2272	2548	2024-03-28_b022c6940f73455c1e6e091b472abdfe_cryptolocker.exe	88
PID 2548 wrote to memory of 2272	2548	2024-03-28_b022c6940f73455c1e6e091b472abdfe_cryptolocker.exe	88
PID 2548 wrote to memory of 2272	2548	2024-03-28_b022c6940f73455c1e6e091b472abdfe_cryptolocker.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-03-28_b022c6940f73455c1e6e091b472abdfe_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-28_b022c6940f73455c1e6e091b472abdfe_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
64KB

MD5
db51939b5fec012f8811f39b00cd1a3b

SHA1
05e67acd0899c7a888c75004bc134ba44c96ad82

SHA256
e39d9fc77c0b341a3a02bbc5908a5b4734b5a88903e5ebcc218c50cc0ede4e1f

SHA512
9e582682d4c7c4dd2cf7fd19364510dd4d760d39d2e77f145ac200abf6f9dad02a5ca0a65e29686514d5846cdb4e9f33c649a15e70873447e88f2dbab5518986

Download Submit
memory/2272-19-0x0000000000750000-0x0000000000756000-memory.dmp

Filesize
24KB

Download
memory/2272-25-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2548-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2548-1-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/2548-2-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/2548-3-0x00000000021B0000-0x00000000021B6000-memory.dmp

Filesize
24KB

Download
memory/2548-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download