50e2bd62e79dae70cabfac87288c82db1a7d2221cce5bf41caec3f0c15c10d74

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-21_f3daad64cedcd0d1bee832db6d75757c_cryptolocker.exe
Size

50KB
MD5

f3daad64cedcd0d1bee832db6d75757c
SHA1

853c2e2f41b2bd51df8ee2b61a562a8a1624f5a0
SHA256

50e2bd62e79dae70cabfac87288c82db1a7d2221cce5bf41caec3f0c15c10d74
SHA512

278cb9cc8e6c1b6cd0603848590e07e6d9a87cec649480b4fd69331b16fa9208e204a74b7d2bc1b6447bea539724da943df9a7dabfe10cc35dda6a08c9971dae
SSDEEP

768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/DpkcAY5E:P6Q0ElP6G+gJQMOtEvwDpjB8WMlf/5E

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2760-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral2/memory/2760-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2736-26-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2760-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral2/memory/2760-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral2/memory/2736-26-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-21_f3daad64cedcd0d1bee832db6d75757c_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	2024-05-21_f3daad64cedcd0d1bee832db6d75757c_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2736 asih.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2736	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-21_f3daad64cedcd0d1bee832db6d75757c_cryptolocker.exe

description	pid	process	target process
PID 2760 wrote to memory of 2736	2760	2024-05-21_f3daad64cedcd0d1bee832db6d75757c_cryptolocker.exe	asih.exe
PID 2760 wrote to memory of 2736	2760	2024-05-21_f3daad64cedcd0d1bee832db6d75757c_cryptolocker.exe	asih.exe
PID 2760 wrote to memory of 2736	2760	2024-05-21_f3daad64cedcd0d1bee832db6d75757c_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_f3daad64cedcd0d1bee832db6d75757c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_f3daad64cedcd0d1bee832db6d75757c_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2760

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
50KB

MD5
396870fcaa99a39389f5acaf8cf58288

SHA1
73daae13554b310880615025f89589d1eed512d2

SHA256
2cd49933bc678938743f865bfaa78ffba116c2fa287943ecb0fd31c7145971a8

SHA512
eb936ced1d9795ed29885b740ed871aea914685119fd239ec4852cfc49856146043532dea5f7f1f714e5daf7f9e5f48695e695c71269c06d440a8120f170d810

Download Submit
memory/2736-19-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/2736-20-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/2736-26-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2760-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2760-1-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/2760-2-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/2760-3-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/2760-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download