5f39ebaace099b1a3c20bfb1f580877e9c0f56ec0c9b0bca7888e1be3214a5bd

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 22:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_5f1a82f1fc0285cafda193533db7ed34_cryptolocker.exe
Size

47KB
MD5

5f1a82f1fc0285cafda193533db7ed34
SHA1

96c4125e94405c8966b8ce7d81af65de1440a595
SHA256

5f39ebaace099b1a3c20bfb1f580877e9c0f56ec0c9b0bca7888e1be3214a5bd
SHA512

f181b149af713c95154f4b99addaaf03eb077992dededb6d00fe8a65adc7d912ba03a740f334376c09af09187fa4a69fb79c7d74ab1910a2243181a4eaf9194f
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLam5aFr7YOzzfm0EXsB7G:V6QFElP6n+gMQMOtEvwDpjyaYaFAh3W6

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000002341c-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000002341c-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	2024-05-23_5f1a82f1fc0285cafda193533db7ed34_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1628	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 1628	3684	2024-05-23_5f1a82f1fc0285cafda193533db7ed34_cryptolocker.exe	82
PID 3684 wrote to memory of 1628	3684	2024-05-23_5f1a82f1fc0285cafda193533db7ed34_cryptolocker.exe	82
PID 3684 wrote to memory of 1628	3684	2024-05-23_5f1a82f1fc0285cafda193533db7ed34_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-05-23_5f1a82f1fc0285cafda193533db7ed34_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_5f1a82f1fc0285cafda193533db7ed34_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
47KB

MD5
f9ec2ebd19b17703b153cc918134213d

SHA1
01175e845d45f41b8435dcf91468452690b41ac6

SHA256
e474c06e33e63e5c45c46fa7da3cc5b736e06169a8987baf203436da241114c6

SHA512
4a064d602123c8d0da0c765034bf928a383c2cd91e62ad8b17a8cb8405d89341b80fce7554e55fa7863c8733df26fe5443c308b4851e014c791450e1a472221c

Download Submit
memory/1628-23-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/1628-17-0x0000000000750000-0x0000000000756000-memory.dmp

Filesize
24KB

Download
memory/3684-0-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/3684-1-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/3684-8-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download