dc042340b1c850c49cacebc387774c504c1be63f60dde9a90dd40ac3a88a006b

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 17:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

202404143f42449df2220bce36da5e4b383eda66cryptolocker.exe
Size

74KB
MD5

3f42449df2220bce36da5e4b383eda66
SHA1

d5f6dec22bbde8b3dcb32ae3ca6e0a259747cb63
SHA256

dc042340b1c850c49cacebc387774c504c1be63f60dde9a90dd40ac3a88a006b
SHA512

7c1f64149d6ffafe7878d906c3c5ed9ad4d7a80367794e272cac8eecb393d3101d7a776d46b8cb64bbad40dff9b053b2941752ea79675e1877b2c2ee7cf93bd4
SSDEEP

1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsaleFY:1nK6a+qdOOtEvwDpj6

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	202404143f42449df2220bce36da5e4b383eda66cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
5552	asih.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5012-0-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral2/files/0x0008000000023262-13.dat	upx
behavioral2/memory/5012-25-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral2/memory/5552-26-0x0000000000500000-0x000000000050F311-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 5552	5012	202404143f42449df2220bce36da5e4b383eda66cryptolocker.exe	91
PID 5012 wrote to memory of 5552	5012	202404143f42449df2220bce36da5e4b383eda66cryptolocker.exe	91
PID 5012 wrote to memory of 5552	5012	202404143f42449df2220bce36da5e4b383eda66cryptolocker.exe	91

C:\Users\Admin\AppData\Local\Temp\202404143f42449df2220bce36da5e4b383eda66cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\202404143f42449df2220bce36da5e4b383eda66cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:5552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3100 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
74KB

MD5
2a2df536d94fe9b87ead86f5a6c29523

SHA1
6a131122f9fbfacde8c460835d2829b0543fa5ce

SHA256
4f66c7bd6110a1e8c9e2e92721b426b57d48211e3614815f3ee6c21acaa82e1b

SHA512
803c7a100178344b39349138dd4a8b9e5b160583bb49704c9631b10d09ef31f299983b92523c8c71ad3026bb300dfed9f547f1c3a11e402f508af45e9f41730a

Download Submit
memory/5012-0-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/5012-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/5012-2-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/5012-3-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/5012-25-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/5552-18-0x0000000000630000-0x0000000000636000-memory.dmp

Filesize
24KB

Download
memory/5552-19-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/5552-26-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download