294eda341d48acfbb51c5571e0fb090d1f6db754072a2b3f87a3c0060bcc1dff

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-21_9184252958fd99a11301fc2ba587b919_cryptolocker.exe
Size

74KB
MD5

9184252958fd99a11301fc2ba587b919
SHA1

7c7c929f44be376c0c4ee130adf6836e42e0ac16
SHA256

294eda341d48acfbb51c5571e0fb090d1f6db754072a2b3f87a3c0060bcc1dff
SHA512

abe50c454058a1154fcf6380e099b87e2b38bf1dd08d6970a9d3a44bd7c8dc29f796da8702cd058a10769b3a9f8c2e0deee8d47c505fbe727215e7eef4d9922f
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1rHsoLjQ:X6a+SOtEvwDpjBZYvQd2w

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000001db0e-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000001db0e-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	2024-04-21_9184252958fd99a11301fc2ba587b919_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1408	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 1408	3816	2024-04-21_9184252958fd99a11301fc2ba587b919_cryptolocker.exe	87
PID 3816 wrote to memory of 1408	3816	2024-04-21_9184252958fd99a11301fc2ba587b919_cryptolocker.exe	87
PID 3816 wrote to memory of 1408	3816	2024-04-21_9184252958fd99a11301fc2ba587b919_cryptolocker.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-04-21_9184252958fd99a11301fc2ba587b919_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-21_9184252958fd99a11301fc2ba587b919_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
75KB

MD5
0ed837df4d48704cbb3e2ffbe2373102

SHA1
2b49e11fc48947a6068205a9b623cbffde235aed

SHA256
7b008c25c9519fd26aa2a06ecc1df979cc3828d352a22f484d4ffe6518256ed0

SHA512
eb88b2a82e1902d2bc3f1aa3e0a19f7066bf564d4dee9c56d040e48e1490a0908db7ed38f718d19fe40ca0ca15048c0426ed437ccb2434ea0424069d33bfe27b

Download Submit
memory/1408-17-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/1408-21-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/3816-0-0x0000000002280000-0x0000000002286000-memory.dmp

Filesize
24KB

Download
memory/3816-1-0x0000000002280000-0x0000000002286000-memory.dmp

Filesize
24KB

Download
memory/3816-2-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download