4094a4611df3920a9697af611d940fadfca70b3fd941598ed2fb0af6e4ebb6a9

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-09_d237fa5ea6b4332f6a616b8b8c03c211_cryptolocker.exe
Size

59KB
MD5

d237fa5ea6b4332f6a616b8b8c03c211
SHA1

eeaa4b536029f5fbd1561e99d79a9c2665f930eb
SHA256

4094a4611df3920a9697af611d940fadfca70b3fd941598ed2fb0af6e4ebb6a9
SHA512

2eae19903840c1386b8266f84fccca01eb87c6f897aba2971263296ffba86dbf6813fd3cddd9f3b290c4ffe8380573ccedf30082d1c102aaff84d476637bf903
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLa5VccPt547/qGAU:V6QFElP6n+gMQMOtEvwDpjyaLccVCbt5

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023215-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023215-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	2024-04-09_d237fa5ea6b4332f6a616b8b8c03c211_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4632	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 4632	4264	2024-04-09_d237fa5ea6b4332f6a616b8b8c03c211_cryptolocker.exe	89
PID 4264 wrote to memory of 4632	4264	2024-04-09_d237fa5ea6b4332f6a616b8b8c03c211_cryptolocker.exe	89
PID 4264 wrote to memory of 4632	4264	2024-04-09_d237fa5ea6b4332f6a616b8b8c03c211_cryptolocker.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-04-09_d237fa5ea6b4332f6a616b8b8c03c211_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-09_d237fa5ea6b4332f6a616b8b8c03c211_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
59KB

MD5
9ea3784a2be714a6e97b8719dc9f7528

SHA1
3b679c4d04273e8d88ba51fa5c8f50f596a1c41f

SHA256
0472707c08a054b7cb42bb4643e83f2882a2614edcbcd7fb69bedad65a516f3c

SHA512
8be21bd5c92a5945a8316c8ed39df458b380ff08ce4ebe0b387881bb896eb3fcd16809ec5d3efdc20bd66db15a6000b4eb0600db4404df68cfe79d79eed67d8f

Download Submit
memory/4264-0-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/4264-1-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/4264-2-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/4632-17-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/4632-19-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download