50e1a0f563d7bf94d23074e5897c64200c0fc1ade302666687881eb3f42bc069

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_a0b1f7e9817d2cab7fa4017e397e6556_cryptolocker.exe
Size

44KB
MD5

a0b1f7e9817d2cab7fa4017e397e6556
SHA1

6a4403aa2a01d2b863baedf0c83577a7fad133b0
SHA256

50e1a0f563d7bf94d23074e5897c64200c0fc1ade302666687881eb3f42bc069
SHA512

a94d8f97683ace17ec2b4ac6da0f6283eafb146c5c773782bbdda07c04bb09e1fa417d580d4c3b3ebad2c0b0c15cddb8fcae64e3db2fb2dac434c77391ae4557
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBVaD3TP7DFHuRcD9Hm:X6QFElP6n+gJQMOtEvwDpjBmzDkWDtm

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-23_a0b1f7e9817d2cab7fa4017e397e6556_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	2024-05-23_a0b1f7e9817d2cab7fa4017e397e6556_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

4768 asih.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4768	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-23_a0b1f7e9817d2cab7fa4017e397e6556_cryptolocker.exe

description	pid	process	target process
PID 2816 wrote to memory of 4768	2816	2024-05-23_a0b1f7e9817d2cab7fa4017e397e6556_cryptolocker.exe	asih.exe
PID 2816 wrote to memory of 4768	2816	2024-05-23_a0b1f7e9817d2cab7fa4017e397e6556_cryptolocker.exe	asih.exe
PID 2816 wrote to memory of 4768	2816	2024-05-23_a0b1f7e9817d2cab7fa4017e397e6556_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_a0b1f7e9817d2cab7fa4017e397e6556_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_a0b1f7e9817d2cab7fa4017e397e6556_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2816

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:4768

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe
Filesize
44KB

MD5
77979593528cf9706f1af39176260a19

SHA1
aacad918a316fc48ce3894fa2f4f4c1c03a3e976

SHA256
2bfb52744382d6233eaa27ee28f2d0a97c08ba3d6ff6b0caeeb6e6e61665080b

SHA512
7c36fe97ff91fd63274241eee3b64b0fbd253415f76e50177d351b3d8820c312e93bb41e34c7dda379faeec3faf1c78c3e9b79f63b09b5420e4b113f447754e8

Download Submit
memory/2816-0-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/2816-1-0x0000000000750000-0x0000000000756000-memory.dmp

Filesize
24KB

Download
memory/2816-8-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/4768-17-0x0000000000760000-0x0000000000766000-memory.dmp

Filesize
24KB

Download