4b945b65055c86741a022fff0af9de0d885c26c2ee5908163e484ccd80c18b90

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 17:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-27_09ca29ae143253d23ff1f85ebaa34b8c_cryptolocker.exe
Size

61KB
MD5

09ca29ae143253d23ff1f85ebaa34b8c
SHA1

c5937969ba3351c4fd6ac07b0e3c1c0a14ba10d3
SHA256

4b945b65055c86741a022fff0af9de0d885c26c2ee5908163e484ccd80c18b90
SHA512

4f5f6e57329750a0d7858b59bc9a24ea1152d05c44e6cac95f4bc6d95a6758058c66cb9645e6be72c0b4e1b7f62ca9ac73cf72bd6c2ad620584733a4885cf119
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjyaLccVCbt5c:V6a+pOtEvwDpjvR

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000c000000023b42-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000c000000023b42-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	2024-04-27_09ca29ae143253d23ff1f85ebaa34b8c_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3080	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 3080	3472	2024-04-27_09ca29ae143253d23ff1f85ebaa34b8c_cryptolocker.exe	84
PID 3472 wrote to memory of 3080	3472	2024-04-27_09ca29ae143253d23ff1f85ebaa34b8c_cryptolocker.exe	84
PID 3472 wrote to memory of 3080	3472	2024-04-27_09ca29ae143253d23ff1f85ebaa34b8c_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-04-27_09ca29ae143253d23ff1f85ebaa34b8c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-27_09ca29ae143253d23ff1f85ebaa34b8c_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
61KB

MD5
e7a056bd0720fa753b4b519f9e2ab5a8

SHA1
481f2266ff2cc77189d73db33ade1cee251d07eb

SHA256
d2da03e31e75328ba6d7328b0e6d6c5f5e268b830ab95bb18c4de0557be7310b

SHA512
e8dc2dacce86835c989621f358302c2887d441e4cc9a6a946cfb7daa71708841ba8c47bd9507e8da39a2419d6fba7d025c64fb17b4d75fbc5b1601ddbe633305

Download Submit
memory/3080-18-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/3080-17-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/3472-0-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/3472-1-0x0000000000860000-0x0000000000866000-memory.dmp

Filesize
24KB

Download
memory/3472-8-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download