df6753a501de5826c4b2a64ea1d84e58be2d67aa746f73ec4e5ef412805d7877

Analysis

max time kernel
149s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 22:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-19_2526995c83ab7fd5ddbe1363f6b0a2b2_cryptolocker.exe
Size

74KB
MD5

2526995c83ab7fd5ddbe1363f6b0a2b2
SHA1

bf616487c5d99df02b82ab3963264fb9721cb4cf
SHA256

df6753a501de5826c4b2a64ea1d84e58be2d67aa746f73ec4e5ef412805d7877
SHA512

bc37716ddcd826f8d1e419398c74de0e27dbc1cae82818bc05ba0f5ed588ea1454022858127aa56672c091c62fd03b8895ef4635f56f0762c82f5833b8498ef3
SSDEEP

1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsaleFL:1nK6a+qdOOtEvwDpjt

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral2/memory/2368-0-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2368-1-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x000700000002324f-14.dat	CryptoLocker_rule2
behavioral2/memory/2368-26-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
behavioral2/memory/3904-27-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral2/memory/2368-0-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
behavioral2/memory/2368-1-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
behavioral2/files/0x000700000002324f-14.dat	CryptoLocker_set1
behavioral2/memory/2368-26-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
behavioral2/memory/3904-27-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral2/memory/2368-0-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
behavioral2/memory/2368-1-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
behavioral2/files/0x000700000002324f-14.dat	UPX
behavioral2/memory/2368-26-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
behavioral2/memory/3904-27-0x0000000000500000-0x000000000050F311-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-04-19_2526995c83ab7fd5ddbe1363f6b0a2b2_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3904	asih.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2368-0-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral2/memory/2368-1-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral2/files/0x000700000002324f-14.dat	upx
behavioral2/memory/2368-26-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral2/memory/3904-27-0x0000000000500000-0x000000000050F311-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 3904	2368	2024-04-19_2526995c83ab7fd5ddbe1363f6b0a2b2_cryptolocker.exe	94
PID 2368 wrote to memory of 3904	2368	2024-04-19_2526995c83ab7fd5ddbe1363f6b0a2b2_cryptolocker.exe	94
PID 2368 wrote to memory of 3904	2368	2024-04-19_2526995c83ab7fd5ddbe1363f6b0a2b2_cryptolocker.exe	94

C:\Users\Admin\AppData\Local\Temp\2024-04-19_2526995c83ab7fd5ddbe1363f6b0a2b2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-19_2526995c83ab7fd5ddbe1363f6b0a2b2_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3724 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
74KB

MD5
f181e69223ca59b8a5f482d78180cf18

SHA1
246287e9b6c93e429b743b04b7e3fc9e5b861549

SHA256
35cb48fc99563274fd215d84344cfec4fc21f53f20e18e05cd47da19a86056b3

SHA512
c2eef750a54d78629cf442eec5d87b3ed0901bdb8283fb311a1e8476509444926c24650b8f204a072cdf943f96f258da20d1cf82fed1c5190cf757105584f8ff

Download Submit
memory/2368-0-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2368-1-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2368-2-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/2368-3-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/2368-4-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/2368-26-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/3904-19-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/3904-20-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/3904-27-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download