8bc44be815ae9c9b5ddcdf4c69db49377241aa29b860e149e52e4d19447774b3

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_0124a7633391aa51e2df3d1c9ca2541c_cryptolocker.exe
Size

49KB
MD5

0124a7633391aa51e2df3d1c9ca2541c
SHA1

4e634bc67688f9c4506e7c3130a84bb85dd90f88
SHA256

8bc44be815ae9c9b5ddcdf4c69db49377241aa29b860e149e52e4d19447774b3
SHA512

4c6e0f5e4be6f54ec95781d5d53da7fc44257c1825d10e5c7bbf5bc92e22e562bba997bbfdd0b5fbc8b7500f3f76b9585fc608b91efc0de3ca763dc6d1ebdc15
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vdXf5:X6QFElP6n+gJBMOtEvwDpjBtEdXf5

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-23_0124a7633391aa51e2df3d1c9ca2541c_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	2024-05-23_0124a7633391aa51e2df3d1c9ca2541c_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

4624 asih.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4624	asih.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-23_0124a7633391aa51e2df3d1c9ca2541c_cryptolocker.exe

description	pid	process	target process
PID 1012 wrote to memory of 4624	1012	2024-05-23_0124a7633391aa51e2df3d1c9ca2541c_cryptolocker.exe	asih.exe
PID 1012 wrote to memory of 4624	1012	2024-05-23_0124a7633391aa51e2df3d1c9ca2541c_cryptolocker.exe	asih.exe
PID 1012 wrote to memory of 4624	1012	2024-05-23_0124a7633391aa51e2df3d1c9ca2541c_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_0124a7633391aa51e2df3d1c9ca2541c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_0124a7633391aa51e2df3d1c9ca2541c_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1012

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:4624

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe
Filesize
49KB

MD5
fc132edbdbab6a393d858a814e48bae3

SHA1
3b48f733c5d23975a4116ee39842d89fb410bc98

SHA256
7a7fdbdf961174d35a5c50d1cd3c0d36c08f1d9ab4d95147a754a975d4fefde0

SHA512
104d5feb8b4ea25ced49353dc6664f987d58020d14c76fecf38ccdd99ec169db679835ab2d1594deec6b3f26d2a317bc23721d12bbe7c2ef938915fc36359134

Download Submit
memory/1012-0-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/1012-1-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/1012-8-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/4624-17-0x0000000002000000-0x0000000002006000-memory.dmp

Filesize
24KB

Download
memory/4624-23-0x0000000001FE0000-0x0000000001FE6000-memory.dmp

Filesize
24KB

Download