cb13d09acf156b10110615a604a6e6e3f54b9e3229ec26e93c1dd3ad4f3cd652

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-07_a4044ae4ddb189826b0a08051ccac8fa_cryptolocker.exe
Size

46KB
MD5

a4044ae4ddb189826b0a08051ccac8fa
SHA1

521aeec0da6f1f000a31d4794eb88a522653e3f0
SHA256

cb13d09acf156b10110615a604a6e6e3f54b9e3229ec26e93c1dd3ad4f3cd652
SHA512

05fb197d430d10f5b7d01336a43a7befc5fd2f90b7c5ceb6003626c029a544dc4c69032952226f3dac7702fc196fe9b70f8d87d48fce9b1c26c7e6fb856e5523
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLam5aFr7YOzzfm0EXsBS:V6QFElP6n+gMQMOtEvwDpjyaYaFAh3WS

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000d000000023b2e-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000d000000023b2e-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	2024-05-07_a4044ae4ddb189826b0a08051ccac8fa_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4688	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 4688	4952	2024-05-07_a4044ae4ddb189826b0a08051ccac8fa_cryptolocker.exe	84
PID 4952 wrote to memory of 4688	4952	2024-05-07_a4044ae4ddb189826b0a08051ccac8fa_cryptolocker.exe	84
PID 4952 wrote to memory of 4688	4952	2024-05-07_a4044ae4ddb189826b0a08051ccac8fa_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-05-07_a4044ae4ddb189826b0a08051ccac8fa_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-07_a4044ae4ddb189826b0a08051ccac8fa_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
46KB

MD5
3fa116979b643f3140acd0d3a37c243c

SHA1
21284da7467608302eb9da1ac9ff2a8e66f91886

SHA256
94834c0a9944f2bfe0c649398dd62f99e6bc32592456ad039761beac1b8a71b8

SHA512
ed71b8040fd75f4b3bba88f7c8f3d234161d8dd4e09793fced881cd9b49bd954ce3f5127ad739b9b3569a5a95e335168acbdb0e219d3481f62c853630c70afc2

Download Submit
memory/4688-17-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/4688-23-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/4952-0-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/4952-1-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/4952-8-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download