ab03e5b35861db02db66095ef7f607698798fdfefde79df982da43e9e97ec3bf

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-13_d5ef1a51b704d287ee20cb595e5f9a8f_cryptolocker.exe
Size

50KB
MD5

d5ef1a51b704d287ee20cb595e5f9a8f
SHA1

e2781aaaadbf043e0313fabeeb2acdb303729bf6
SHA256

ab03e5b35861db02db66095ef7f607698798fdfefde79df982da43e9e97ec3bf
SHA512

38f722f1c9959e57564d138c97c6810c1f04c6e3ab3158a2a6e84dc7b84fa93a9bc784d49493eb6a9fb406ac06b72bdb239a407471ace3344d47e58340b5934f
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaaEqbIu55id3AMWZY/:X6QFElP6n+gJQMOtEvwDpjB0GIWiWLi/

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023256-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023256-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-05-13_d5ef1a51b704d287ee20cb595e5f9a8f_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1132	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 1132	4848	2024-05-13_d5ef1a51b704d287ee20cb595e5f9a8f_cryptolocker.exe	90
PID 4848 wrote to memory of 1132	4848	2024-05-13_d5ef1a51b704d287ee20cb595e5f9a8f_cryptolocker.exe	90
PID 4848 wrote to memory of 1132	4848	2024-05-13_d5ef1a51b704d287ee20cb595e5f9a8f_cryptolocker.exe	90

C:\Users\Admin\AppData\Local\Temp\2024-05-13_d5ef1a51b704d287ee20cb595e5f9a8f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-13_d5ef1a51b704d287ee20cb595e5f9a8f_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
51KB

MD5
eaa6cc5067c811033337801ace54bb31

SHA1
a438cb160e8237728c50cb4fc81468e2d8fa9800

SHA256
c35eae18e6c407f58f0486df9f051041a3834a4dc1139e995a812644b8e27615

SHA512
2e7ab9cb6da265d3cbcaca053df0d2b6c296fc56d5b7cb843a13cd4b39c44752f8a44571c7cfd8646af56988871724b4a9a35e537e2631c4ffc9c670088459de

Download Submit
memory/1132-17-0x00000000007D0000-0x00000000007D6000-memory.dmp

Filesize
24KB

Download
memory/1132-18-0x00000000007F0000-0x00000000007F6000-memory.dmp

Filesize
24KB

Download
memory/4848-0-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/4848-1-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/4848-2-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download