92a7a81feebfab2d7c1349a510b30db55dde981e56b11a7a0f0e4ac3dea51a06

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-10_14a87ba804d031c1d37f83d35cb63315_cryptolocker.exe
Size

46KB
MD5

14a87ba804d031c1d37f83d35cb63315
SHA1

dc705b20ec2de5fbc34bf3e2faec3e7cb3927479
SHA256

92a7a81feebfab2d7c1349a510b30db55dde981e56b11a7a0f0e4ac3dea51a06
SHA512

6672bbcc08eeea2d09af8210f595f305e165e1cf438a126892fb4103fd2d7a12b79084b7788f2240e042bb7ea7739049fe7af60f1c419df909f83b7d0a4ccfc6
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLam5aFr7YOzzfm0EXs+:V6QFElP6n+gMQMOtEvwDpjyaYaFAh3x

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00060000000232a6-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x00060000000232a6-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	2024-05-10_14a87ba804d031c1d37f83d35cb63315_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4944	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 4944	2816	2024-05-10_14a87ba804d031c1d37f83d35cb63315_cryptolocker.exe	81
PID 2816 wrote to memory of 4944	2816	2024-05-10_14a87ba804d031c1d37f83d35cb63315_cryptolocker.exe	81
PID 2816 wrote to memory of 4944	2816	2024-05-10_14a87ba804d031c1d37f83d35cb63315_cryptolocker.exe	81

C:\Users\Admin\AppData\Local\Temp\2024-05-10_14a87ba804d031c1d37f83d35cb63315_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-10_14a87ba804d031c1d37f83d35cb63315_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
46KB

MD5
db3324732e1c06cdf14d2a3c5ff20a43

SHA1
be7d29f58882195e71eac3df14da80c35e9233e8

SHA256
4ca2750b0e34752806eb71ef5d259f1f9b758e9ad2cf932e1f6bec13bce9dd38

SHA512
bd082b4fed1fbd0136c43e1d9763eeff1393007fd2701118b86aa0785c0fcffd58365d9feab746cc233a01e87766b8585a1d1b1b97f940a0967768e199c603fd

Download Submit
memory/2816-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2816-1-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/2816-8-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4944-17-0x00000000007D0000-0x00000000007D6000-memory.dmp

Filesize
24KB

Download
memory/4944-23-0x00000000007B0000-0x00000000007B6000-memory.dmp

Filesize
24KB

Download