c08d27c297b71056b2b1dab6d40a41706b2fe679b088a7ac617514c96e153585

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 15:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-21_0c358f89cefb7d6c2517136edc0a3e75_cryptolocker.exe
Size

46KB
MD5

0c358f89cefb7d6c2517136edc0a3e75
SHA1

51caa37161e3c627dc153aa3c89fd47057621b25
SHA256

c08d27c297b71056b2b1dab6d40a41706b2fe679b088a7ac617514c96e153585
SHA512

1e2d8c877b103b2ba582a98d00f221dc230dddb836a38b42654126c69141d88c61d0615966a1d9841aa3b7c7cfe10d89ef6a3f8d9b40b27b61855f2c4de5a841
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLam5aFr7YOzzfm0EXsJU:V6QFElP6n+gMQMOtEvwDpjyaYaFAh3x

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-21_0c358f89cefb7d6c2517136edc0a3e75_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	2024-05-21_0c358f89cefb7d6c2517136edc0a3e75_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2968 asih.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2968	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-21_0c358f89cefb7d6c2517136edc0a3e75_cryptolocker.exe

description	pid	process	target process
PID 920 wrote to memory of 2968	920	2024-05-21_0c358f89cefb7d6c2517136edc0a3e75_cryptolocker.exe	asih.exe
PID 920 wrote to memory of 2968	920	2024-05-21_0c358f89cefb7d6c2517136edc0a3e75_cryptolocker.exe	asih.exe
PID 920 wrote to memory of 2968	920	2024-05-21_0c358f89cefb7d6c2517136edc0a3e75_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_0c358f89cefb7d6c2517136edc0a3e75_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_0c358f89cefb7d6c2517136edc0a3e75_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:920
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
46KB

MD5
36d8f0a6286ccfcee9c192f879cec2de

SHA1
883ae6be89837079ad54ed90fbaad40db5a4dd65

SHA256
17c701d986f2111423e5eab4d9f1d6c1bff7123774c16d282bcab4b97fdf4954

SHA512
2f198ca2e32a3d09c18922a2f935f55b539f2e8dcf587f1fdb0b0d88093079db2b1b58c838b16fe48006069c437a7b8b27eaf4d53e12b5eac82c8ee099564fb1

Download Submit
memory/920-0-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/920-3-0x00000000007D0000-0x00000000007D6000-memory.dmp

Filesize
24KB

Download
memory/920-8-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/2968-17-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/2968-23-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download