b17b96c8dceeeb1b1d45b0c4d46497926ba5b937eadcb51f8458fb8bf50c2e98

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_1f79ec5c6e0516efd441efb814299c4a_cryptolocker.exe
Size

49KB
MD5

1f79ec5c6e0516efd441efb814299c4a
SHA1

db94cd6efb53109df793941d4cc97ad36cb6827c
SHA256

b17b96c8dceeeb1b1d45b0c4d46497926ba5b937eadcb51f8458fb8bf50c2e98
SHA512

187ed3259110b134adfdd335dbf7f189e388b5d36d5de1a0fe9c5ca5944507015e034272dbe036a98c5fee168f2592cbca2fb4ff863763a0e719dc2545ecc5a9
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vdXf3:X6QFElP6n+gJBMOtEvwDpjBtEdXf3

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-23_1f79ec5c6e0516efd441efb814299c4a_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	2024-05-23_1f79ec5c6e0516efd441efb814299c4a_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

3008 asih.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3008	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-23_1f79ec5c6e0516efd441efb814299c4a_cryptolocker.exe

description	pid	process	target process
PID 4216 wrote to memory of 3008	4216	2024-05-23_1f79ec5c6e0516efd441efb814299c4a_cryptolocker.exe	asih.exe
PID 4216 wrote to memory of 3008	4216	2024-05-23_1f79ec5c6e0516efd441efb814299c4a_cryptolocker.exe	asih.exe
PID 4216 wrote to memory of 3008	4216	2024-05-23_1f79ec5c6e0516efd441efb814299c4a_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_1f79ec5c6e0516efd441efb814299c4a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_1f79ec5c6e0516efd441efb814299c4a_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4216

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:3008

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe
Filesize
49KB

MD5
c0e551cbc8e19de40ccb2b5c8ec9cb21

SHA1
257b9d67138cabb43188b49cd0ed68c6b368ab9c

SHA256
6f12cbe9042837ec3c8e6a7692e786dfd464fc9f8775d139e7c00f3d2b532440

SHA512
aede1df294cfa33faceead3143b63f30f40ad353bc94e182eeabc2c1a37ca3d7fd12d0c9cdb1bcf950782c110e10774078d84662fc1d978ed72be4092c975930

Download Submit
memory/3008-17-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/3008-23-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4216-0-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/4216-1-0x0000000000510000-0x0000000000516000-memory.dmp

Filesize
24KB

Download
memory/4216-8-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download