7e8a3d247a78f44ad6cc0dc771a0eece22d0f23ff6f42306bd269edd884a439c

Analysis

max time kernel
157s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 11:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-28_7a0c439123d11a1914d9840f1ba2a4a6_cryptolocker.exe
Size

136KB
MD5

7a0c439123d11a1914d9840f1ba2a4a6
SHA1

f0d55beabf2d3ffe1acf275a3424011e36e2ee92
SHA256

7e8a3d247a78f44ad6cc0dc771a0eece22d0f23ff6f42306bd269edd884a439c
SHA512

b949f900d89827a78487603da6dbfd5d4296711c2c840fd10c58e56997336b3a081de7ffb2fe368f3b61e12c24ca42483da223eb56cbfb044fb19044f645fd96
SSDEEP

1536:u6QFElP6n+gWMOtEvwDpjJGYQbN/PKwNgpwqWsviPe5Yk:u6a++OtEvwDpj6zs

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023236-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023236-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	2024-03-28_7a0c439123d11a1914d9840f1ba2a4a6_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2096	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2096	1640	2024-03-28_7a0c439123d11a1914d9840f1ba2a4a6_cryptolocker.exe	87
PID 1640 wrote to memory of 2096	1640	2024-03-28_7a0c439123d11a1914d9840f1ba2a4a6_cryptolocker.exe	87
PID 1640 wrote to memory of 2096	1640	2024-03-28_7a0c439123d11a1914d9840f1ba2a4a6_cryptolocker.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-03-28_7a0c439123d11a1914d9840f1ba2a4a6_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-28_7a0c439123d11a1914d9840f1ba2a4a6_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
136KB

MD5
c0e118e56645f018b9bc03b2b4b78684

SHA1
07dcc8ffa5672231b155d0bd9a4ccc8318771202

SHA256
d35bf2634d2cb0586cfdf5a47b545c0bb9fb03ed483c8bed641336046a9b1bc9

SHA512
5bac947c485d600fcadff1331bef9ec69c70bf20ee6662e7eda8f7f823f2f1c28d26f280269759d86abc8a69ef8e7d416c8c65855ccd6b021f90f9a608e98015

Download Submit
memory/1640-0-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/1640-1-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/1640-2-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/2096-17-0x0000000002080000-0x0000000002086000-memory.dmp

Filesize
24KB

Download
memory/2096-19-0x0000000001F10000-0x0000000001F16000-memory.dmp

Filesize
24KB

Download