6f555b61a7e4ac9d9d12a93524e18a6f8f92609820f3f53c7e59db0bd6974a48

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 06:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-27_c176987173c76b0bc646c8d52d663c01_cryptolocker.exe
Size

51KB
MD5

c176987173c76b0bc646c8d52d663c01
SHA1

a10e2415ddbcc3fa3919c6cfb2b26e35eef1cb03
SHA256

6f555b61a7e4ac9d9d12a93524e18a6f8f92609820f3f53c7e59db0bd6974a48
SHA512

bddf49b27fd15d97b8702e9c5dcd100c64a8b9c2c031aa7541bac05e4758cb5b651de5bbb756ca693ec2d275dbf5ab7c426f9660715041216b9f4f5abe87ad57
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vxmlcaTs:X6QFElP6n+gJBMOtEvwDpjBtExmlA

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000002343a-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000002343a-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	2024-04-27_c176987173c76b0bc646c8d52d663c01_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3892	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 3892	1804	2024-04-27_c176987173c76b0bc646c8d52d663c01_cryptolocker.exe	82
PID 1804 wrote to memory of 3892	1804	2024-04-27_c176987173c76b0bc646c8d52d663c01_cryptolocker.exe	82
PID 1804 wrote to memory of 3892	1804	2024-04-27_c176987173c76b0bc646c8d52d663c01_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-04-27_c176987173c76b0bc646c8d52d663c01_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-27_c176987173c76b0bc646c8d52d663c01_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
52KB

MD5
79f54bdd3611a5f424ebbcad8221203c

SHA1
a25e9dbc2d16e6ec1cb7dcc0e01f8b014c28aa47

SHA256
9fa288dd7e0d958453026d45d988a87ad3bfbdb00850e31bdbe76606432e6e40

SHA512
56f4b9af7a6f9a9abd32a5a6cfc5a08d052c2572eb984dbc2df61d9de1379d2bf8be9c5b103d1b4e00575072f9dea1b6c1d71f3e6621d1e5c5526b15cd2f95df

Download Submit
memory/1804-0-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/1804-1-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/1804-8-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/3892-17-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/3892-23-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download