148c6c8cbf5a414939df7f9d81df4682ecfe5bfc909c8f2b6b3fcbe4e5c527ba

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_28115cef1005bb07c7a103df4ec7ba64_cryptolocker.exe
Size

49KB
MD5

28115cef1005bb07c7a103df4ec7ba64
SHA1

2462325d66a22db8c53fbbff94cfb5b4a22456c8
SHA256

148c6c8cbf5a414939df7f9d81df4682ecfe5bfc909c8f2b6b3fcbe4e5c527ba
SHA512

7d67ef1dc72763c9d45952c1c1a728983bced4c567a330d24a4d86402f783eeafa2147df9c525bc51718dc8a8ab172e62aaffeeb5ea768343f6a4c60064389a1
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vdXfi:X6QFElP6n+gJBMOtEvwDpjBtEdXfi

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-23_28115cef1005bb07c7a103df4ec7ba64_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	2024-05-23_28115cef1005bb07c7a103df4ec7ba64_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2728 asih.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2728	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-23_28115cef1005bb07c7a103df4ec7ba64_cryptolocker.exe

description	pid	process	target process
PID 1340 wrote to memory of 2728	1340	2024-05-23_28115cef1005bb07c7a103df4ec7ba64_cryptolocker.exe	asih.exe
PID 1340 wrote to memory of 2728	1340	2024-05-23_28115cef1005bb07c7a103df4ec7ba64_cryptolocker.exe	asih.exe
PID 1340 wrote to memory of 2728	1340	2024-05-23_28115cef1005bb07c7a103df4ec7ba64_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_28115cef1005bb07c7a103df4ec7ba64_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_28115cef1005bb07c7a103df4ec7ba64_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1340

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:2728

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe
Filesize
49KB

MD5
db70a923d3ce59b8a4a2d5c680274320

SHA1
bc0a5a7d840abfe658c16781494a4d631938f6e0

SHA256
0f87502af464ef4fa723c47a3254067a01ef11c2bb9dfdd473e8bd237589a1c8

SHA512
a5f081167b090cb310aa448f3d19bf95a6004a3bac52a74231bd7980aada92bf9f9098706519c80f25a5a97cb790985acb489dda58c90f06b593d38051c59639

Download Submit
memory/1340-0-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/1340-1-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/1340-8-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/2728-23-0x0000000000670000-0x0000000000676000-memory.dmp

Filesize
24KB

Download
memory/2728-17-0x0000000002100000-0x0000000002106000-memory.dmp

Filesize
24KB

Download