96a53ccbe3393a99745334fe20d3aa48c61cf52c2ec501b85801dbab711cefed

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-12_018dee2476c3671fa54a5751a888975e_cryptolocker.exe
Size

42KB
MD5

018dee2476c3671fa54a5751a888975e
SHA1

ee323ff6d7a331f788b1730eb75854d79087f73e
SHA256

96a53ccbe3393a99745334fe20d3aa48c61cf52c2ec501b85801dbab711cefed
SHA512

ece173b00668ce438d3dfc5ab03542ec5681220728dc457c9db43697811f9573cab043b1aaae7a9cd46243652524838a35aa5c26dbba2f805b0c0e1dc5220a4c
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBVaD3TP7DFHuRcY:X6QFElP6n+gJQMOtEvwDpjBmzDkWY

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000a0000000233c0-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000a0000000233c0-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	2024-05-12_018dee2476c3671fa54a5751a888975e_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3576	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 3576	2264	2024-05-12_018dee2476c3671fa54a5751a888975e_cryptolocker.exe	82
PID 2264 wrote to memory of 3576	2264	2024-05-12_018dee2476c3671fa54a5751a888975e_cryptolocker.exe	82
PID 2264 wrote to memory of 3576	2264	2024-05-12_018dee2476c3671fa54a5751a888975e_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-05-12_018dee2476c3671fa54a5751a888975e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-12_018dee2476c3671fa54a5751a888975e_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
43KB

MD5
40aa243037c4f3aa677a3c5cc68c39db

SHA1
76eaef9409a0ea69583399c872af228701c8d8d7

SHA256
26e9a1b11d9aa8460e0859d6b19a13547a37f1757e0463e707a7b7208ed0b579

SHA512
ff7615926c257ede02d318e45623b1ee593188e17360dccddbfcf6b456c2871a8d7c79bd75bde05398db279f1fde8a81e16a0854899a45e14e06a758e44626a4

Download Submit
memory/2264-0-0x00000000020D0000-0x00000000020D6000-memory.dmp

Filesize
24KB

Download
memory/2264-1-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/2264-8-0x00000000020D0000-0x00000000020D6000-memory.dmp

Filesize
24KB

Download
memory/3576-17-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/3576-23-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download