6833120fb3c1f8ed2b8b55965a3fa8d29f14587b27e56919bfce614198fbc5fa

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-21_f5f2ce847cdd9a84fad3296145cb882e_cryptolocker.exe
Size

61KB
MD5

f5f2ce847cdd9a84fad3296145cb882e
SHA1

d7a24de3e23b856a9186f50c72f5d6240a6e5aca
SHA256

6833120fb3c1f8ed2b8b55965a3fa8d29f14587b27e56919bfce614198fbc5fa
SHA512

ff14c8d71d2a6bc04531a0e0d381f75d6e346180a453e7c762c9f2be18a686a0ab498f1204908289da1b81fb9dae25f69820ae9611e9a30239a69d8fc2825a47
SSDEEP

1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHNMhvV:1nK6a+qdOOtEvwDpjd

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4524-0-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral2/memory/4524-17-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
behavioral2/memory/3924-26-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4524-0-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral2/memory/4524-17-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
behavioral2/memory/3924-26-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4524-0-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
C:\Users\Admin\AppData\Local\Temp\asih.exe	UPX
behavioral2/memory/4524-17-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
behavioral2/memory/3924-26-0x0000000000500000-0x000000000050F311-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-21_f5f2ce847cdd9a84fad3296145cb882e_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	2024-05-21_f5f2ce847cdd9a84fad3296145cb882e_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

3924 asih.exe

pid	process
3924	asih.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4524-0-0x0000000000500000-0x000000000050F311-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\asih.exe	upx
behavioral2/memory/4524-17-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral2/memory/3924-26-0x0000000000500000-0x000000000050F311-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-21_f5f2ce847cdd9a84fad3296145cb882e_cryptolocker.exe

description	pid	process	target process
PID 4524 wrote to memory of 3924	4524	2024-05-21_f5f2ce847cdd9a84fad3296145cb882e_cryptolocker.exe	asih.exe
PID 4524 wrote to memory of 3924	4524	2024-05-21_f5f2ce847cdd9a84fad3296145cb882e_cryptolocker.exe	asih.exe
PID 4524 wrote to memory of 3924	4524	2024-05-21_f5f2ce847cdd9a84fad3296145cb882e_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_f5f2ce847cdd9a84fad3296145cb882e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_f5f2ce847cdd9a84fad3296145cb882e_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4524

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:3924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
62KB

MD5
1909d6c83116ae03e8c9d456befd0191

SHA1
d096c6ff7c75a7839e85750afc4699b473a280fe

SHA256
6b5b2ad98a0c418c3f3c7361cc1b97ba631b6fc5715d892ac8dc8a747d7e1784

SHA512
448f0c94a34d2ac0cb2956892b4ad3e6e5bad0eb8748b605f01221db1c8da23e2caf18c2839cee9153bf337df15bdf84bc24f85b66d2a992b8151063bf9afa9b

Download Submit
memory/3924-19-0x0000000002080000-0x0000000002086000-memory.dmp

Filesize
24KB

Download
memory/3924-25-0x0000000002060000-0x0000000002066000-memory.dmp

Filesize
24KB

Download
memory/3924-26-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/4524-0-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/4524-1-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/4524-2-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/4524-9-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/4524-17-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download