4442fd992b97c1e690cda4a944992298ed1ae7c187853737fc6d28a2c64edbc0

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-24_6b6ca414cfc2fddc684b4fa9d74ec34b_cryptolocker.exe
Size

38KB
MD5

6b6ca414cfc2fddc684b4fa9d74ec34b
SHA1

dee4a98eb93ec018f85f465ea62387ffce26d27b
SHA256

4442fd992b97c1e690cda4a944992298ed1ae7c187853737fc6d28a2c64edbc0
SHA512

fa99513735edb4e44b1f91ea4abc48b00ac522ec45738ca298d1997e419f043fe71d9be30ee55e4ba96f8b877b2f5b68b1419b8792c309f182d2beb9b5bb5f21
SSDEEP

768:qUmnjFom/kLyMro2GtOOtEvwDpjeMLam5axK3Dh:qUmnpomddpMOtEvwDpjjaYaQl

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2264-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral2/memory/2264-18-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/4084-27-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2264-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral2/memory/2264-18-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral2/memory/4084-27-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2264-0-0x0000000000500000-0x000000000050F000-memory.dmp	UPX
C:\Users\Admin\AppData\Local\Temp\asih.exe	UPX
behavioral2/memory/2264-18-0x0000000000500000-0x000000000050F000-memory.dmp	UPX
behavioral2/memory/4084-27-0x0000000000500000-0x000000000050F000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-24_6b6ca414cfc2fddc684b4fa9d74ec34b_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	2024-05-24_6b6ca414cfc2fddc684b4fa9d74ec34b_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

4084 asih.exe

pid	process
4084	asih.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2264-0-0x0000000000500000-0x000000000050F000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\asih.exe	upx
behavioral2/memory/2264-18-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/memory/4084-27-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-24_6b6ca414cfc2fddc684b4fa9d74ec34b_cryptolocker.exe

description	pid	process	target process
PID 2264 wrote to memory of 4084	2264	2024-05-24_6b6ca414cfc2fddc684b4fa9d74ec34b_cryptolocker.exe	asih.exe
PID 2264 wrote to memory of 4084	2264	2024-05-24_6b6ca414cfc2fddc684b4fa9d74ec34b_cryptolocker.exe	asih.exe
PID 2264 wrote to memory of 4084	2264	2024-05-24_6b6ca414cfc2fddc684b4fa9d74ec34b_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-24_6b6ca414cfc2fddc684b4fa9d74ec34b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_6b6ca414cfc2fddc684b4fa9d74ec34b_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
38KB

MD5
81cc7ce88bd383c42f2fa80606e01487

SHA1
7eebbba42b59b0cdb80de843ed84495af5768785

SHA256
d4405c479f460e5a13fc1573f7f189232b873b67b6f848a6cbc35f69509c0c8e

SHA512
dcbd10f01af28c836fd657b85d0ba3fd79978619ffdde090a0d2500367467497680284530888680cceb8e5291ca9a9fc198e2078c8e34615ebe0093b7d01df57

Download Submit
memory/2264-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2264-1-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/2264-2-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/2264-4-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/2264-18-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4084-20-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/4084-26-0x0000000000570000-0x0000000000576000-memory.dmp

Filesize
24KB

Download
memory/4084-27-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download