e4fc241496bd0c1ff886bbb7560fce1e1797e3b2d89e39e5c9895a3e6e6d83a5

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_10b25386bc32e25f67bc03a4f4ed7ce9_cryptolocker.exe
Size

60KB
MD5

10b25386bc32e25f67bc03a4f4ed7ce9
SHA1

2052c3bd6e94b75619779b2c8a5bf24a6ab4c160
SHA256

e4fc241496bd0c1ff886bbb7560fce1e1797e3b2d89e39e5c9895a3e6e6d83a5
SHA512

910c8e98ff799dfc4ff7fc50246e3fa8b4a8b12ae3c7ff670a4f0a66647bf53445c8f333de6a4ed86bde068b7002e3cc904407019fa21886202febfd7d448763
SSDEEP

1536:z6QFElP6n+gKmddpMOtEvwDpj9aYaUf3y:z6a+CdOOtEvwDpjQ1

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3044-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral2/memory/3044-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/3780-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3044-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral2/memory/3044-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/3780-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3044-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
C:\Users\Admin\AppData\Local\Temp\asih.exe	UPX
behavioral2/memory/3044-17-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral2/memory/3780-26-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-23_10b25386bc32e25f67bc03a4f4ed7ce9_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	2024-05-23_10b25386bc32e25f67bc03a4f4ed7ce9_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

3780 asih.exe

pid	process
3780	asih.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3044-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\asih.exe	upx
behavioral2/memory/3044-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/3780-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-23_10b25386bc32e25f67bc03a4f4ed7ce9_cryptolocker.exe

description	pid	process	target process
PID 3044 wrote to memory of 3780	3044	2024-05-23_10b25386bc32e25f67bc03a4f4ed7ce9_cryptolocker.exe	asih.exe
PID 3044 wrote to memory of 3780	3044	2024-05-23_10b25386bc32e25f67bc03a4f4ed7ce9_cryptolocker.exe	asih.exe
PID 3044 wrote to memory of 3780	3044	2024-05-23_10b25386bc32e25f67bc03a4f4ed7ce9_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_10b25386bc32e25f67bc03a4f4ed7ce9_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_10b25386bc32e25f67bc03a4f4ed7ce9_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3044

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:3780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4120,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:8
1⤵
PID:4048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
61KB

MD5
872745d29ea33d2da258d60bbbbbb7de

SHA1
9cc7fa9974013397506c33be29b1ca11361d2565

SHA256
19a2944911f1ffc12d2b1aabb85fd85c119fe576815e9a8075241353846fbf58

SHA512
8ff3143cafcf4cc4281021add9e627aeadaa22ba0d8890ded0c45755f3fbb47d317765f4463fd7bdfd4c53b6fc995b9c316cd3465e0e8a8cda3f97819ace5fde

Download Submit
memory/3044-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3044-1-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/3044-2-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/3044-9-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/3044-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3780-19-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/3780-25-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/3780-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download