f2abf15e4848c7f37bb988d8d56a35d787dba45f1ffd8476b72c2afa9eb12abb

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 21:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-03_d005acfa0ef8d23b1374bf0f746c396f_cryptolocker.exe
Size

38KB
MD5

d005acfa0ef8d23b1374bf0f746c396f
SHA1

f3566db3c9cc1585a53093010dc8563c08e2e329
SHA256

f2abf15e4848c7f37bb988d8d56a35d787dba45f1ffd8476b72c2afa9eb12abb
SHA512

3e45a0eb523e867644a29fc7078d0976f14eb07a9ab0efabdbd34dfa610dbbdf804cc4cda36e68e6da1b32428131d138d83a52004b6f4410da5d1106fa374219
SSDEEP

768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYanz:qDdFJy3QMOtEvwDpjjWMl7Tdnz

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/1260-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x000b00000002324f-13.dat	CryptoLocker_rule2
behavioral2/memory/1260-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/4856-27-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral2/memory/1260-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x000b00000002324f-13.dat	CryptoLocker_set1
behavioral2/memory/1260-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/4856-27-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/1260-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral2/files/0x000b00000002324f-13.dat	UPX
behavioral2/memory/1260-25-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral2/memory/4856-27-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-05-03_d005acfa0ef8d23b1374bf0f746c396f_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4856	asih.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1260-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x000b00000002324f-13.dat	upx
behavioral2/memory/1260-25-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4856-27-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 4856	1260	2024-05-03_d005acfa0ef8d23b1374bf0f746c396f_cryptolocker.exe	91
PID 1260 wrote to memory of 4856	1260	2024-05-03_d005acfa0ef8d23b1374bf0f746c396f_cryptolocker.exe	91
PID 1260 wrote to memory of 4856	1260	2024-05-03_d005acfa0ef8d23b1374bf0f746c396f_cryptolocker.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-05-03_d005acfa0ef8d23b1374bf0f746c396f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-03_d005acfa0ef8d23b1374bf0f746c396f_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5056 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
38KB

MD5
635293b012bc93eccccbf0ef1a441b05

SHA1
6c9bc536090f295ef990f019646747d67394f49f

SHA256
728caa24e674f8775dbeee300616f5f6f6cd82a42f743bef39f9fdfd29199d02

SHA512
c7810ab1281372978c79a29b75851bae08ceafa6ab6534bad56b615ea85e8fc0b998f62902b67561a8859be09d107504f957b3d101e8c0d31473911049d1b7ef

Download Submit
memory/1260-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1260-1-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/1260-2-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/1260-3-0x00000000007E0000-0x00000000007E6000-memory.dmp

Filesize
24KB

Download
memory/1260-25-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4856-19-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/4856-26-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/4856-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download