fa0e54a543b4ff39baffe7c8aaa17a54c9c855b41f63443369a3294c898cc0de

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-11_a2786f2fb148260422762bf805f04f99_cryptolocker.exe
Size

122KB
MD5

a2786f2fb148260422762bf805f04f99
SHA1

5c19fdb478fb56c154679f99860d619d73e33d56
SHA256

fa0e54a543b4ff39baffe7c8aaa17a54c9c855b41f63443369a3294c898cc0de
SHA512

5dddeb4beb57a445f56363cea97c13c7389f488a283cc6ca3b82c519fdbea67b1d956c7acf974c9308692ed7f5857ad49c3aa3a922e22b7a60349e66c967a1e5
SSDEEP

1536:u6QFElP6n+gWMOtEvwDpjJGYQbN/PKwMgP:u6a++OtEvwDpj6zL

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023221-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023221-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	2024-04-11_a2786f2fb148260422762bf805f04f99_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1148	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 1148	4680	2024-04-11_a2786f2fb148260422762bf805f04f99_cryptolocker.exe	83
PID 4680 wrote to memory of 1148	4680	2024-04-11_a2786f2fb148260422762bf805f04f99_cryptolocker.exe	83
PID 4680 wrote to memory of 1148	4680	2024-04-11_a2786f2fb148260422762bf805f04f99_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-04-11_a2786f2fb148260422762bf805f04f99_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-11_a2786f2fb148260422762bf805f04f99_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
123KB

MD5
06b8850814c07f22279663c847a55999

SHA1
c64272b9c7c9acb70ebd9628fbf3c26533234947

SHA256
ea5384a831c93848fc4d7eb70d7d58ac91a16578df1cee83640b6fd43e7f7cc0

SHA512
5270e9de9a15d7c095ea40f5d86374bd5b68fb8652d16f9b53b349b2deb8f3adae35856299651c485b5185c193f362694eb3deca0bc4a735fabb7d981c1fb57c

Download Submit
memory/1148-17-0x0000000001FF0000-0x0000000001FF6000-memory.dmp

Filesize
24KB

Download
memory/1148-19-0x0000000001FD0000-0x0000000001FD6000-memory.dmp

Filesize
24KB

Download
memory/4680-0-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download
memory/4680-1-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download
memory/4680-2-0x0000000000750000-0x0000000000756000-memory.dmp

Filesize
24KB

Download