bed2571c533504f79bd077b3c45ab07548c940123dfd9a8cd62f4d57809c59b9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_c04938556ed9a60c919173e83e12a49f_cryptolocker.exe
Size

39KB
MD5

c04938556ed9a60c919173e83e12a49f
SHA1

e5759a332f7f7714db9fb35e1ae57d1d9c9d3613
SHA256

bed2571c533504f79bd077b3c45ab07548c940123dfd9a8cd62f4d57809c59b9
SHA512

85e0d9b1371bf38d69ce89e11a501c0e3da2a01c04f4444803dc77f366410601753af62dd9ebdfd1e4943ded1da6b99ee07c996cf9e3b15fc2e43ef2d08327c3
SSDEEP

768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYaQ8:qDdFJy3QMOtEvwDpjjWMl7Tdh

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3156-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral2/memory/3156-19-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/1144-18-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/1144-28-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3156-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral2/memory/3156-19-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/1144-18-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/1144-28-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3156-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
C:\Users\Admin\AppData\Local\Temp\asih.exe	UPX
behavioral2/memory/3156-19-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral2/memory/1144-18-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral2/memory/1144-28-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-22_c04938556ed9a60c919173e83e12a49f_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	2024-05-22_c04938556ed9a60c919173e83e12a49f_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

1144 asih.exe

pid	process
1144	asih.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3156-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\asih.exe	upx
behavioral2/memory/3156-19-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/1144-18-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/1144-28-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-22_c04938556ed9a60c919173e83e12a49f_cryptolocker.exe

description	pid	process	target process
PID 3156 wrote to memory of 1144	3156	2024-05-22_c04938556ed9a60c919173e83e12a49f_cryptolocker.exe	asih.exe
PID 3156 wrote to memory of 1144	3156	2024-05-22_c04938556ed9a60c919173e83e12a49f_cryptolocker.exe	asih.exe
PID 3156 wrote to memory of 1144	3156	2024-05-22_c04938556ed9a60c919173e83e12a49f_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_c04938556ed9a60c919173e83e12a49f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_c04938556ed9a60c919173e83e12a49f_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3156

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:1144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
39KB

MD5
eceaf139aac4594edd37f10710d12354

SHA1
e6674a46b68080dd0f9751b62d9921cab00cc62f

SHA256
c3df8ab1afe75616e2de33c1cda8c826bbdb6f19ecaa53280a8b250ab36d7d62

SHA512
84d60d047fe5ba17635aa355da6cee196df8b45bdb4addfb2787871f46a9a5ce026b5702d36309203787e067563a28c34208ff304297da3c335ba19861ba8b8b

Download Submit
memory/1144-18-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1144-22-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/1144-27-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/1144-28-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3156-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3156-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/3156-2-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/3156-9-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/3156-19-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download