e1b86dadd702b0ad1841c9db893a5d531d9eef71a4de32449ab2e47251f9e0fe

Analysis

max time kernel
143s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_b5dd3aebebf1a6ea209ef302a20faad2_cryptolocker.exe
Size

47KB
MD5

b5dd3aebebf1a6ea209ef302a20faad2
SHA1

d8d8971cb1aa6c5021d5e0b562332a109df298d3
SHA256

e1b86dadd702b0ad1841c9db893a5d531d9eef71a4de32449ab2e47251f9e0fe
SHA512

69157c240c4c039420b607777f7c354ab46cb36063b4ea46b6101a0119621472a925487338223d20b4bbe6e36242b59b83e0d494fd55f5ad20e10038d608cbd9
SSDEEP

384:e/4wODQkzonAYsju5N/surDQtOOtEvwDpjqIGROqS/WccJVJwi2B5oCCM8CLW2VE:79inqyNR/QtOOtEvwDpjBKccJVODvy3d

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3164-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral2/memory/3164-25-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3164-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral2/memory/3164-25-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-23_b5dd3aebebf1a6ea209ef302a20faad2_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-05-23_b5dd3aebebf1a6ea209ef302a20faad2_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

3304 asih.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3304	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-23_b5dd3aebebf1a6ea209ef302a20faad2_cryptolocker.exe

description	pid	process	target process
PID 3164 wrote to memory of 3304	3164	2024-05-23_b5dd3aebebf1a6ea209ef302a20faad2_cryptolocker.exe	asih.exe
PID 3164 wrote to memory of 3304	3164	2024-05-23_b5dd3aebebf1a6ea209ef302a20faad2_cryptolocker.exe	asih.exe
PID 3164 wrote to memory of 3304	3164	2024-05-23_b5dd3aebebf1a6ea209ef302a20faad2_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_b5dd3aebebf1a6ea209ef302a20faad2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_b5dd3aebebf1a6ea209ef302a20faad2_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3164

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4192 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
48KB

MD5
8d88818dbcb8dfd39b8583aac0519915

SHA1
58443c0ece504ac17ccf3252e1809c836fa80db3

SHA256
0dc87282ee076bd6934b74847bb40560b5358e1a9b4719f4bd162efe37fca307

SHA512
5c074969079952177fc0665ca2bfa57e3c7b7685180dbaf9a689228bf3fcf360b12bf18225fe134b904c0071934813b6e2f29118399c7e4aa26c78495088cebf

Download Submit
memory/3164-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3164-1-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/3164-2-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/3164-3-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/3164-25-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3304-18-0x0000000002060000-0x0000000002066000-memory.dmp

Filesize
24KB

Download
memory/3304-24-0x00000000021E0000-0x00000000021E6000-memory.dmp

Filesize
24KB

Download