8a732c045288710bd82c8133329103f3e141ae266c7d455a11687a2b8accf913

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-05_cb88277afe215a053c4cfe621d32f00e_cryptolocker.exe
Size

75KB
MD5

cb88277afe215a053c4cfe621d32f00e
SHA1

7694d6fba42a84c586a9a2ea0204000612b9edce
SHA256

8a732c045288710bd82c8133329103f3e141ae266c7d455a11687a2b8accf913
SHA512

74a816dc52a9ab8ab173974f29990aaa4036b18319293c1811a4ee37a04595f57d36cbe3e3698c50da2bcec7f9f540d22f57def8501ce488c5c5d59f81431445
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1rHsoLkE:X6a+SOtEvwDpjBZYvQd2r

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023288-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023288-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	2024-05-05_cb88277afe215a053c4cfe621d32f00e_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2076	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 2076	404	2024-05-05_cb88277afe215a053c4cfe621d32f00e_cryptolocker.exe	82
PID 404 wrote to memory of 2076	404	2024-05-05_cb88277afe215a053c4cfe621d32f00e_cryptolocker.exe	82
PID 404 wrote to memory of 2076	404	2024-05-05_cb88277afe215a053c4cfe621d32f00e_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-05-05_cb88277afe215a053c4cfe621d32f00e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-05_cb88277afe215a053c4cfe621d32f00e_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:404
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
75KB

MD5
25e3b8e6c9570283ea48d966caa03b73

SHA1
150b935b9ef34720e1f0307107ca823a88435952

SHA256
c4b8a2dcebfcdd06fa7d4b8f0e08a6eb318ca4a1483a30765011c9b2c3b41868

SHA512
6a251eba068ce00c41e331b014940af179d82f941579c0130188513122dd770f2b0d8d55b4c18f48c2433915b3bd5ac55200b5177d62d38c13e6ce794b9db469

Download Submit
memory/404-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/404-1-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/404-8-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download