cf43ddd4d95de2e95f78a0efb19b4e97b1b264208cdcc273a384ed810f86403e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-21_38a3179741a7b7dbfddb3fe823a3120e_cryptolocker.exe
Size

79KB
MD5

38a3179741a7b7dbfddb3fe823a3120e
SHA1

8654ed5a12be7661a187a9323a6a72cbc3f59d0f
SHA256

cf43ddd4d95de2e95f78a0efb19b4e97b1b264208cdcc273a384ed810f86403e
SHA512

4105eaffba37d58edf57ff5d50665118227ca19dc5666e84dac0241a500bcb27140bc80f6d040a4dd50f681e8d69d10418a92a801727f3ce7079a67f467db23b
SSDEEP

1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOAkXtBdJcRQ:T6a+rdOOtEvwDpjNtl

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2060-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral2/memory/548-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2060-18-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/548-27-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2060-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral2/memory/548-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/2060-18-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/548-27-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2060-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
C:\Users\Admin\AppData\Local\Temp\asih.exe	UPX
behavioral2/memory/548-17-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral2/memory/2060-18-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral2/memory/548-27-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-21_38a3179741a7b7dbfddb3fe823a3120e_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	2024-05-21_38a3179741a7b7dbfddb3fe823a3120e_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

548 asih.exe

pid	process
548	asih.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2060-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\asih.exe	upx
behavioral2/memory/548-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/2060-18-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/548-27-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-21_38a3179741a7b7dbfddb3fe823a3120e_cryptolocker.exe

description	pid	process	target process
PID 2060 wrote to memory of 548	2060	2024-05-21_38a3179741a7b7dbfddb3fe823a3120e_cryptolocker.exe	asih.exe
PID 2060 wrote to memory of 548	2060	2024-05-21_38a3179741a7b7dbfddb3fe823a3120e_cryptolocker.exe	asih.exe
PID 2060 wrote to memory of 548	2060	2024-05-21_38a3179741a7b7dbfddb3fe823a3120e_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_38a3179741a7b7dbfddb3fe823a3120e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_38a3179741a7b7dbfddb3fe823a3120e_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
79KB

MD5
3fe1cea3496bfdde479e7b78c84553ab

SHA1
31125e48a01d65816d308368448521376bb97d0a

SHA256
83590eb182bf3f89a9cd3c0ecf14fe9cd428a6dd4b5c7a8dede3c088e55091ea

SHA512
04b42a175eb5b91258f1551ce302fb30cea2e697892c3d8422b6655696e35c31c54d4af63e70f967b2070f49432ef802aefebac7e21e341f247a152e8ae017ad

Download Submit
memory/548-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/548-20-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/548-26-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/548-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2060-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2060-1-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/2060-3-0x0000000000750000-0x0000000000756000-memory.dmp

Filesize
24KB

Download
memory/2060-2-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/2060-18-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download