Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 02:22
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-22_073201000b3d45a8de986cd57b8992d8_cryptolocker.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-05-22_073201000b3d45a8de986cd57b8992d8_cryptolocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-22_073201000b3d45a8de986cd57b8992d8_cryptolocker.exe
-
Size
41KB
-
MD5
073201000b3d45a8de986cd57b8992d8
-
SHA1
d647e350e61c467959f0de71e80415d2e6ce674a
-
SHA256
70bb9faea93f27366deed89be5aed194a0168e5863c784f0e221e8f73211eae2
-
SHA512
bab2de62d5759e1f86afe0eeb3d79baa381308929392648249de782a4d24dd3ee2bac39ea433076af0418e2ae12f197d57b9d61214a29d2434a1dd8fd284c15e
-
SSDEEP
768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaac4HKcfr9OrC:X6QFElP6n+gJQMOtEvwDpjBsYK6r0rC
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\asih.exe CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\asih.exe CryptoLocker_set1 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-05-22_073201000b3d45a8de986cd57b8992d8_cryptolocker.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation 2024-05-22_073201000b3d45a8de986cd57b8992d8_cryptolocker.exe -
Executes dropped EXE 1 IoCs
Processes:
asih.exepid process 4152 asih.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-05-22_073201000b3d45a8de986cd57b8992d8_cryptolocker.exedescription pid process target process PID 2272 wrote to memory of 4152 2272 2024-05-22_073201000b3d45a8de986cd57b8992d8_cryptolocker.exe asih.exe PID 2272 wrote to memory of 4152 2272 2024-05-22_073201000b3d45a8de986cd57b8992d8_cryptolocker.exe asih.exe PID 2272 wrote to memory of 4152 2272 2024-05-22_073201000b3d45a8de986cd57b8992d8_cryptolocker.exe asih.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_073201000b3d45a8de986cd57b8992d8_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_073201000b3d45a8de986cd57b8992d8_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\asih.exeFilesize
41KB
MD52141e4627b35f10681160f8ea737b4fa
SHA1dc48596f5d66860f396689a13a10766d2a2c2746
SHA25612bc78cd4a401b24141bc571ded1cb612987b20459af565c265bd468790a53c8
SHA512d557c31ff6849c65a99df47f216103c3742b2dc65a883df2c8def99a4e2d78ba78f53abd1475d04f85d644dea8257fc669d9da13fc572295eed556519bbac502
-
memory/2272-0-0x00000000020D0000-0x00000000020D6000-memory.dmpFilesize
24KB
-
memory/2272-1-0x00000000020F0000-0x00000000020F6000-memory.dmpFilesize
24KB
-
memory/2272-8-0x00000000020D0000-0x00000000020D6000-memory.dmpFilesize
24KB
-
memory/4152-17-0x00000000004F0000-0x00000000004F6000-memory.dmpFilesize
24KB
-
memory/4152-23-0x00000000004D0000-0x00000000004D6000-memory.dmpFilesize
24KB