67f8d41b5f384cdc26e82e1d0f08a2f8ab4af119219fc577dcb092ec87c35e0e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 07:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-16_9aebdce1259a510e835b7410a7d6e7d2_cryptolocker.exe
Size

74KB
MD5

9aebdce1259a510e835b7410a7d6e7d2
SHA1

d523e21a1d2ff74ed96a6bb4835c8cc182ae1940
SHA256

67f8d41b5f384cdc26e82e1d0f08a2f8ab4af119219fc577dcb092ec87c35e0e
SHA512

c8ffbb1cdf3d5b118b407698fa75301459bb598fb17cd783551ee0e201e7989365f5cf31f07835527f7a559771672b0a6e46e0d868e4893a78c28f6fd3a8481f
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1rHs2:X6a+SOtEvwDpjBZYvQd2N

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x001c00000001e97e-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x001c00000001e97e-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	2024-04-16_9aebdce1259a510e835b7410a7d6e7d2_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4076	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 4076	1936	2024-04-16_9aebdce1259a510e835b7410a7d6e7d2_cryptolocker.exe	86
PID 1936 wrote to memory of 4076	1936	2024-04-16_9aebdce1259a510e835b7410a7d6e7d2_cryptolocker.exe	86
PID 1936 wrote to memory of 4076	1936	2024-04-16_9aebdce1259a510e835b7410a7d6e7d2_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-04-16_9aebdce1259a510e835b7410a7d6e7d2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-16_9aebdce1259a510e835b7410a7d6e7d2_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
74KB

MD5
2df36065ac9584855fcf826b54b262a6

SHA1
26e92ef6e760eff6676a1c607eab542d4c941355

SHA256
769d530fc95c5d0044fcd5029c61d87752439a37461566c7f1b7622cffc5b9aa

SHA512
fd1cd88805bd5a0188c6b5f47958960190638aa659ce19930c8c7498e3bd9dd66a87d80c770411871665f05c2f1ddf7e07bbee3f6a7f45013281509d14ca97ca

Download Submit
memory/1936-0-0x0000000000650000-0x0000000000656000-memory.dmp

Filesize
24KB

Download
memory/1936-1-0x0000000000650000-0x0000000000656000-memory.dmp

Filesize
24KB

Download
memory/1936-2-0x0000000000700000-0x0000000000706000-memory.dmp

Filesize
24KB

Download
memory/4076-17-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/4076-21-0x00000000004C0000-0x00000000004C6000-memory.dmp

Filesize
24KB

Download