9c0e2f17469c885c99d41ce5cad875133f439e8605b6595fe2a4ed2c4442c98f

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-27_cedd4166f731ba98f69e48cf14477fa1_cryptolocker.exe
Size

60KB
MD5

cedd4166f731ba98f69e48cf14477fa1
SHA1

331fd4d37296dd86ce502b4cd50cd04d275b4f7e
SHA256

9c0e2f17469c885c99d41ce5cad875133f439e8605b6595fe2a4ed2c4442c98f
SHA512

0f3c16b00e12ea9e1f484747d3d635348388ecb8df25e4b77e7c7d21055e7f75d1507aea7e7eacc5c2097425c10ffc2000648e2b0da3d4ff925bc86418c6ed2f
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjyaLccVCbtCK:V6a+pOtEvwDpjv0

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000c000000023b7c-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000c000000023b7c-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation	2024-04-27_cedd4166f731ba98f69e48cf14477fa1_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2288	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 2288	4548	2024-04-27_cedd4166f731ba98f69e48cf14477fa1_cryptolocker.exe	83
PID 4548 wrote to memory of 2288	4548	2024-04-27_cedd4166f731ba98f69e48cf14477fa1_cryptolocker.exe	83
PID 4548 wrote to memory of 2288	4548	2024-04-27_cedd4166f731ba98f69e48cf14477fa1_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-04-27_cedd4166f731ba98f69e48cf14477fa1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-27_cedd4166f731ba98f69e48cf14477fa1_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
60KB

MD5
01be41e9fce7837440cf5432b6a0ccac

SHA1
76a1ecfe4ad19de527276e1b201443427361ce35

SHA256
d0e6bc553e1357b3d94614aa1615ebcdbbd9cf182a0acf45a8ca12a6c6c6a31f

SHA512
d6b6a70d7773ce0b764a9f7069e94e8b2a035c8b4ad64b04551ce0c8ccefc802cd6f9d6ee5a690123d4f8f9616d98966bb3aa3d669c980a7e6ab20cf8e9704f2

Download Submit
memory/2288-17-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/2288-23-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4548-0-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/4548-1-0x00000000007E0000-0x00000000007E6000-memory.dmp

Filesize
24KB

Download
memory/4548-8-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download