24f4e4787a03f402c4c7a636f6ea15b7584ba80bf10a06904c0eb2b4dff0e18a

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_6280b4a510b5a2c3fd055a62b3f419a0_cryptolocker.exe
Size

73KB
MD5

6280b4a510b5a2c3fd055a62b3f419a0
SHA1

ba6b49716e894788d9631db0621213a55949fa49
SHA256

24f4e4787a03f402c4c7a636f6ea15b7584ba80bf10a06904c0eb2b4dff0e18a
SHA512

ca2666a0b8eb9b9e90993b140ac8421a35ebfcd87e38689b9db9b0094fd67b8ce2a27aff30c6d3ff80acf258c2dd2580fc65f8d782964a1cb016bf2484ff097c
SSDEEP

768:u6LsoEEeegiZPvEhHSG+gZgtOOtEvwDpjeY10Y/YMsY:u6QFElP6n+gWMOtEvwDpjJGYQbY

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-22_6280b4a510b5a2c3fd055a62b3f419a0_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	2024-05-22_6280b4a510b5a2c3fd055a62b3f419a0_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

1372 asih.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1372	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-22_6280b4a510b5a2c3fd055a62b3f419a0_cryptolocker.exe

description	pid	process	target process
PID 3576 wrote to memory of 1372	3576	2024-05-22_6280b4a510b5a2c3fd055a62b3f419a0_cryptolocker.exe	asih.exe
PID 3576 wrote to memory of 1372	3576	2024-05-22_6280b4a510b5a2c3fd055a62b3f419a0_cryptolocker.exe	asih.exe
PID 3576 wrote to memory of 1372	3576	2024-05-22_6280b4a510b5a2c3fd055a62b3f419a0_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_6280b4a510b5a2c3fd055a62b3f419a0_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_6280b4a510b5a2c3fd055a62b3f419a0_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3576

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:1372

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe
Filesize
73KB

MD5
2492ff358f094025f401da2c7e771f9c

SHA1
bb21d5facab90ed6049acada163f34cb5cee4092

SHA256
ab6d0db96b0cc7fa2d1c8f02ca1105413171369f29dbc9c3d487d6c4fbe3fef1

SHA512
bd9e0195a7a72d95582576f15b21340e63d1ebd7f7077b5e915e27f71eed437b1bebe6668116148335712b803bfd475c1452091fc233ff004d597646f3ab03ef

Download Submit
memory/1372-23-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/1372-17-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/3576-0-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/3576-1-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/3576-8-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download