5a90df55146dae999268cd3a4c6916c2784c531f572100cda79fda142eeb4135

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_bd7a9a07e997bd4fe01f836fce69daca_cryptolocker.exe
Size

79KB
MD5

bd7a9a07e997bd4fe01f836fce69daca
SHA1

f538ed724282e3463605f5e1c520341fb602dbd3
SHA256

5a90df55146dae999268cd3a4c6916c2784c531f572100cda79fda142eeb4135
SHA512

ea36740010d81676b8b2fb704f23f46f2e32d1e55e5066ecbd874450d6e7f80785caa931877ab4b4c721dfde71a9d630a41b98a03c3ce42a140fd5ba8f57eb72
SSDEEP

1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOAkXtBdxPUxB14n:T6a+rdOOtEvwDpjNtHPJ

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3708-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral2/memory/3708-18-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2920-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3708-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral2/memory/3708-18-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/2920-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3708-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
C:\Users\Admin\AppData\Local\Temp\asih.exe	UPX
behavioral2/memory/3708-18-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral2/memory/2920-26-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-22_bd7a9a07e997bd4fe01f836fce69daca_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-05-22_bd7a9a07e997bd4fe01f836fce69daca_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2920 asih.exe

pid	process
2920	asih.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3708-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\asih.exe	upx
behavioral2/memory/3708-18-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/2920-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-22_bd7a9a07e997bd4fe01f836fce69daca_cryptolocker.exe

description	pid	process	target process
PID 3708 wrote to memory of 2920	3708	2024-05-22_bd7a9a07e997bd4fe01f836fce69daca_cryptolocker.exe	asih.exe
PID 3708 wrote to memory of 2920	3708	2024-05-22_bd7a9a07e997bd4fe01f836fce69daca_cryptolocker.exe	asih.exe
PID 3708 wrote to memory of 2920	3708	2024-05-22_bd7a9a07e997bd4fe01f836fce69daca_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_bd7a9a07e997bd4fe01f836fce69daca_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_bd7a9a07e997bd4fe01f836fce69daca_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3708

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:3716

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe
Filesize
79KB

MD5
9b2323df24f13288b33129273fe494ed

SHA1
a90c6cda52da0c1a929c06e1a3579a1f0854e207

SHA256
ca929f22ef3c4a530122d229ec3f40c3669ff8da288f5d69730d49f02993a82c

SHA512
9b2ee9b37a44ec0bc80403f0e548076f8d26c537f2fc97ae95b0df0a4e67841792a4257e3ea23b59db985bbf790f87fd8e437453fc6b44f6cd006ada20027bea

Download Submit
memory/2920-20-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/2920-19-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/2920-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3708-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3708-1-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/3708-2-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/3708-3-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/3708-18-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download