c0660e6b0720c8c3bc524edc1b4c17670ef1a65f5b8f7ab20a954b11f1d1440a

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_4cd25b17a9417483d8be7a7f32989f5f_cryptolocker.exe
Size

52KB
MD5

4cd25b17a9417483d8be7a7f32989f5f
SHA1

1fe188cb7b45e2ad2934f72aa4f699a4e70b102c
SHA256

c0660e6b0720c8c3bc524edc1b4c17670ef1a65f5b8f7ab20a954b11f1d1440a
SHA512

28e1dc66650e1cf360bb2a914a0c8318cff46154039e6853758cd0e56b46af93191ce39ee55c2c6fcec122642e8609b4938459f60aa232a1bbb83240894861fd
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vxmlcaT2:X6QFElP6n+gJBMOtEvwDpjBtExmlC

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-22_4cd25b17a9417483d8be7a7f32989f5f_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	2024-05-22_4cd25b17a9417483d8be7a7f32989f5f_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

3684 asih.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3684	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-22_4cd25b17a9417483d8be7a7f32989f5f_cryptolocker.exe

description	pid	process	target process
PID 1200 wrote to memory of 3684	1200	2024-05-22_4cd25b17a9417483d8be7a7f32989f5f_cryptolocker.exe	asih.exe
PID 1200 wrote to memory of 3684	1200	2024-05-22_4cd25b17a9417483d8be7a7f32989f5f_cryptolocker.exe	asih.exe
PID 1200 wrote to memory of 3684	1200	2024-05-22_4cd25b17a9417483d8be7a7f32989f5f_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_4cd25b17a9417483d8be7a7f32989f5f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_4cd25b17a9417483d8be7a7f32989f5f_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1200

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:3684

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe
Filesize
52KB

MD5
d407b9a5940114ab99159a81b9141eac

SHA1
9c7ae3c726baaf18ebc3b082e3ca640119afe397

SHA256
3f4922e749868a3708991566d2c94bcdde6db2a8df1506c5c33744c1844b05e1

SHA512
1e3a3708ad657b003eb699482233a3bc638d81e7de3e44598be49af21dfa50e1a4025e72b0d5c59bb956196c646593639004277a2f2e521b71f851c0a0c1b86c

Download Submit
memory/1200-0-0x00000000021C0000-0x00000000021C6000-memory.dmp

Filesize
24KB

Download
memory/1200-1-0x00000000020E0000-0x00000000020E6000-memory.dmp

Filesize
24KB

Download
memory/1200-8-0x00000000021C0000-0x00000000021C6000-memory.dmp

Filesize
24KB

Download
memory/3684-17-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/3684-23-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download