Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/05/2024, 18:50

General

  • Target

    2024-05-21_eb494cc659bacc266b0e619a71984940_cryptolocker.exe

  • Size

    71KB

  • MD5

    eb494cc659bacc266b0e619a71984940

  • SHA1

    b6e05bb36df21803d6093db080054706cb7ceb05

  • SHA256

    4c079ccf50da96b753ba0e7e38c7e194b37732c1a807a5a6c9d87de4747ffaa5

  • SHA512

    3975ae81dfe1b0a0d4cd42598022e2c621a3a38b4197b16b3f5c9e79358b64974a54b7b1d3c15c754be0a752e3fac5364a2e3e13cc3cd795a7addd023d71d2c6

  • SSDEEP

    1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKUNZOa:DW60sllyWOtEvwDpjwF85Z

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 4 IoCs
  • Detection of Cryptolocker Samples 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-21_eb494cc659bacc266b0e619a71984940_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-21_eb494cc659bacc266b0e619a71984940_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4472
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:1336

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    72KB

    MD5

    7e81a34ecb4bb2fd9656c0482f0611bd

    SHA1

    2ee1d0204eff83110b6ab26f3092251fc7c2ce9a

    SHA256

    03d8b942f8d76a201adaa27a400341def4f89d3878b1d9dfd87444e4fff93590

    SHA512

    d91476dfd57b85f5063f132b7a1022825f8860080725fcfd7242de48fa2cffea7e6e747cdb4000d0b3f77941d289b3f738e43a021fed6bfc00984df577331e96

  • memory/1336-17-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/4472-0-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/4472-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/4472-2-0x00000000004F0000-0x00000000004F6000-memory.dmp

    Filesize

    24KB

  • memory/4472-9-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/4472-18-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB