447c6c75cdba7082bdd8eb386f5ad6e1bf2c0b0a4bdfca31e411daa647306c9e

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-21_5c945e904e56c1008ca77d32a5b6e4f4_cryptolocker.exe
Size

78KB
MD5

5c945e904e56c1008ca77d32a5b6e4f4
SHA1

513c9dc7d2e933ca455fbff10476c2555e7a18a2
SHA256

447c6c75cdba7082bdd8eb386f5ad6e1bf2c0b0a4bdfca31e411daa647306c9e
SHA512

69283cb14ff7c9f424f493fc7ca0fa262ad0e6f9983ebe3b4de8bcb5f6ab7c9961b5723249744dfac8cce983bb54bc1dbc6062dcabc4a6aea829db91e734cc79
SSDEEP

1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOAkXtBdxPUxB1FV:T6a+rdOOtEvwDpjNtHPU

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4072-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral2/memory/540-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/4072-18-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/540-27-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4072-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral2/memory/540-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/4072-18-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/540-27-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4072-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
C:\Users\Admin\AppData\Local\Temp\asih.exe	UPX
behavioral2/memory/540-17-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral2/memory/4072-18-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral2/memory/540-27-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-21_5c945e904e56c1008ca77d32a5b6e4f4_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	2024-05-21_5c945e904e56c1008ca77d32a5b6e4f4_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

540 asih.exe

pid	process
540	asih.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4072-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\asih.exe	upx
behavioral2/memory/540-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4072-18-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/540-27-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-21_5c945e904e56c1008ca77d32a5b6e4f4_cryptolocker.exe

description	pid	process	target process
PID 4072 wrote to memory of 540	4072	2024-05-21_5c945e904e56c1008ca77d32a5b6e4f4_cryptolocker.exe	asih.exe
PID 4072 wrote to memory of 540	4072	2024-05-21_5c945e904e56c1008ca77d32a5b6e4f4_cryptolocker.exe	asih.exe
PID 4072 wrote to memory of 540	4072	2024-05-21_5c945e904e56c1008ca77d32a5b6e4f4_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_5c945e904e56c1008ca77d32a5b6e4f4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_5c945e904e56c1008ca77d32a5b6e4f4_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4072

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:540

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe
Filesize
78KB

MD5
24f22018fa777634999474a7d4da4ea6

SHA1
93c4e66ff38a590d869c1b1a23b56540fe66eacf

SHA256
c32e9dcb8ef08fbee6d6a04e133ace5759fa1e0dd4355e6ec405195cab9e869d

SHA512
fecaeb44917559da49149c64e5dacb2daf83cbbe71e55be96b89b1011d58dde1e02481506b87a992e2699344d046ea2066820a2bebd7351e77713a8b09535673

Download Submit
memory/540-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/540-20-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/540-21-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/540-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4072-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4072-1-0x00000000020E0000-0x00000000020E6000-memory.dmp

Filesize
24KB

Download
memory/4072-2-0x0000000002100000-0x0000000002106000-memory.dmp

Filesize
24KB

Download
memory/4072-9-0x00000000020E0000-0x00000000020E6000-memory.dmp

Filesize
24KB

Download
memory/4072-18-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download