b7e14afdad82075a641378045d86cccd1553a876fd60a12cc5ed45d29ec8b5f7

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_ee7ecb2612f880e6b3507c862bc62657_cryptolocker.exe
Size

39KB
MD5

ee7ecb2612f880e6b3507c862bc62657
SHA1

341f5d46b7d2e6f8e3601f46a9032c37ce5dd269
SHA256

b7e14afdad82075a641378045d86cccd1553a876fd60a12cc5ed45d29ec8b5f7
SHA512

c2aca7850998f422381e92a221cd5241e8053ad54cb753e384982a26dbd6bb911ae4b46977787394cf828343ae5957682acc320f5b6983f6f20f3f78b1f2cd1f
SSDEEP

768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYaBx:qDdFJy3QMOtEvwDpjjWMl7TdH

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4992-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral2/memory/2552-19-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/4992-18-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2552-28-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4992-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral2/memory/2552-19-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/4992-18-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/2552-28-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4992-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
C:\Users\Admin\AppData\Local\Temp\asih.exe	UPX
behavioral2/memory/2552-19-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral2/memory/4992-18-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral2/memory/2552-28-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-23_ee7ecb2612f880e6b3507c862bc62657_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	2024-05-23_ee7ecb2612f880e6b3507c862bc62657_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2552 asih.exe

pid	process
2552	asih.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4992-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\asih.exe	upx
behavioral2/memory/2552-19-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4992-18-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/2552-28-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-23_ee7ecb2612f880e6b3507c862bc62657_cryptolocker.exe

description	pid	process	target process
PID 4992 wrote to memory of 2552	4992	2024-05-23_ee7ecb2612f880e6b3507c862bc62657_cryptolocker.exe	asih.exe
PID 4992 wrote to memory of 2552	4992	2024-05-23_ee7ecb2612f880e6b3507c862bc62657_cryptolocker.exe	asih.exe
PID 4992 wrote to memory of 2552	4992	2024-05-23_ee7ecb2612f880e6b3507c862bc62657_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_ee7ecb2612f880e6b3507c862bc62657_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_ee7ecb2612f880e6b3507c862bc62657_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4992

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
40KB

MD5
1830b67cafbf8486357c07c0aef09ad3

SHA1
8df446dbfcb6fe90796caad4497ecab93b340d4e

SHA256
f5c87bbec08dab07eb4ef65f0917103721e3de133ffcddd061c065426a5a5db0

SHA512
de5ec2893d1360a0e8a9984b4947b0086f7a2cbb9827980a34075917363852236cef65db53105b1c65e1ba6554240e31c5f4345bac85f4f2545c15ab967c0d73

Download Submit
memory/2552-19-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2552-21-0x0000000000740000-0x0000000000746000-memory.dmp

Filesize
24KB

Download
memory/2552-22-0x0000000000770000-0x0000000000776000-memory.dmp

Filesize
24KB

Download
memory/2552-28-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4992-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4992-2-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/4992-1-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/4992-9-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/4992-18-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download