0cde0710aef412a93eca6251d349218bfa966c178c904a60c30bc6393096bf46

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-28_d778d080165607d81e5333d61625db66_cryptolocker.exe
Size

130KB
MD5

d778d080165607d81e5333d61625db66
SHA1

d88e8186495eeaa996baab828c5b4dedef5a19d9
SHA256

0cde0710aef412a93eca6251d349218bfa966c178c904a60c30bc6393096bf46
SHA512

d2d4cbd6d81f50a7884e2c4c51ac54b0de837634b7fe8f3adbed47bbbae93fe2081988e0e88efd477fcfbb02aefb411308236960b8d855f05e692e4e49699e4b
SSDEEP

1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp699GNtL1eI7B:AnBdOOtEvwDpj6zw

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/4408-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x000800000002325e-13.dat	CryptoLocker_rule2
behavioral2/memory/4408-26-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2320-27-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral2/memory/4408-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x000800000002325e-13.dat	CryptoLocker_set1
behavioral2/memory/4408-26-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral2/memory/2320-27-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/4408-0-0x0000000000500000-0x000000000050F000-memory.dmp	UPX
behavioral2/files/0x000800000002325e-13.dat	UPX
behavioral2/memory/4408-26-0x0000000000500000-0x000000000050F000-memory.dmp	UPX
behavioral2/memory/2320-27-0x0000000000500000-0x000000000050F000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-04-28_d778d080165607d81e5333d61625db66_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2320	asih.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4408-0-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/files/0x000800000002325e-13.dat	upx
behavioral2/memory/4408-26-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/memory/2320-27-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 2320	4408	2024-04-28_d778d080165607d81e5333d61625db66_cryptolocker.exe	90
PID 4408 wrote to memory of 2320	4408	2024-04-28_d778d080165607d81e5333d61625db66_cryptolocker.exe	90
PID 4408 wrote to memory of 2320	4408	2024-04-28_d778d080165607d81e5333d61625db66_cryptolocker.exe	90

C:\Users\Admin\AppData\Local\Temp\2024-04-28_d778d080165607d81e5333d61625db66_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-28_d778d080165607d81e5333d61625db66_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4828 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:4056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
130KB

MD5
df8b15e763afaf47401b329db28ed362

SHA1
0547fde023d6b024eec46191b3cf673a3d7e0460

SHA256
b43764e950dfdd9e68930059905b087bd09e627f8740128834e879d64e9c24b9

SHA512
c8579e3b0fcd8ebdbbcf607c0b8ae4b872159d4d3ec4583615f155741ff038f9e090cb67a52ba1d73a95c27eaccdcc6af02ba42078a85ef044a5203b1a46f7e7

Download Submit
memory/2320-18-0x00000000007D0000-0x00000000007D6000-memory.dmp

Filesize
24KB

Download
memory/2320-24-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/2320-27-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4408-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4408-1-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download
memory/4408-2-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download
memory/4408-3-0x0000000000750000-0x0000000000756000-memory.dmp

Filesize
24KB

Download
memory/4408-26-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download