9cc4cde6ac6ad892ef05f7945536b6c258481a79265ff444ea9d2ff1386cc4f9

General

Target

2024-05-27_17dc357b9a0bec511d08f76196bec1e8_cryptolocker.exe
Size

89KB
MD5

17dc357b9a0bec511d08f76196bec1e8
SHA1

38f5457542582c1c49d0105e4044a2dff40a8277
SHA256

9cc4cde6ac6ad892ef05f7945536b6c258481a79265ff444ea9d2ff1386cc4f9
SHA512

1be97b47d0e6d465524a807118231beb42664031b72164113e4b28f422609eda26d6347b6f512ea582647b117076477cc4beb41494099b1f5aea459eeef3da97
SSDEEP

768:qkmnjFom/kLyMro2GtOOtEvwDpjeY10Y/YMsvlMdwPK80GQuchoIgtIODwt:qkmnpomddpMOtEvwDpjJGYQbN/PKwMg0

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral2/memory/4664-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x0009000000023607-13.dat	CryptoLocker_rule2
behavioral2/memory/4664-18-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/3272-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/3272-27-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral2/memory/4664-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x0009000000023607-13.dat	CryptoLocker_set1
behavioral2/memory/4664-18-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral2/memory/3272-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral2/memory/3272-27-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral2/memory/4664-0-0x0000000000500000-0x000000000050F000-memory.dmp	UPX
behavioral2/files/0x0009000000023607-13.dat	UPX
behavioral2/memory/4664-18-0x0000000000500000-0x000000000050F000-memory.dmp	UPX
behavioral2/memory/3272-17-0x0000000000500000-0x000000000050F000-memory.dmp	UPX
behavioral2/memory/3272-27-0x0000000000500000-0x000000000050F000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	2024-05-27_17dc357b9a0bec511d08f76196bec1e8_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3272	asih.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4664-0-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/files/0x0009000000023607-13.dat	upx
behavioral2/memory/4664-18-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/memory/3272-17-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/memory/3272-27-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 3272	4664	2024-05-27_17dc357b9a0bec511d08f76196bec1e8_cryptolocker.exe	90
PID 4664 wrote to memory of 3272	4664	2024-05-27_17dc357b9a0bec511d08f76196bec1e8_cryptolocker.exe	90
PID 4664 wrote to memory of 3272	4664	2024-05-27_17dc357b9a0bec511d08f76196bec1e8_cryptolocker.exe	90

C:\Users\Admin\AppData\Local\Temp\2024-05-27_17dc357b9a0bec511d08f76196bec1e8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-27_17dc357b9a0bec511d08f76196bec1e8_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4372,i,15142778360084620907,1763097090506261076,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
1⤵
PID:4160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
89KB

MD5
8f7c9b4245ea7c365ad0983476ccc36c

SHA1
c0306c59bf3322a690b228f8b89c5ecadddec105

SHA256
2d8fc0cbeeb8b43311f89feb528d99739e31e9c67acff2920da4812fae3a41e9

SHA512
db3bdfc1d6ca568a157964eca2af72bdfb19de5fbb8a453079fac1171b56f912e995b774b0a3b91604084ca6ed83ded1aa90003287aaa784b9a09e27f343b8e8

Download Submit
memory/3272-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3272-26-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/3272-20-0x0000000000760000-0x0000000000766000-memory.dmp

Filesize
24KB

Download
memory/3272-27-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4664-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4664-1-0x0000000001FD0000-0x0000000001FD6000-memory.dmp

Filesize
24KB

Download
memory/4664-2-0x0000000002000000-0x0000000002006000-memory.dmp

Filesize
24KB

Download
memory/4664-9-0x0000000001FD0000-0x0000000001FD6000-memory.dmp

Filesize
24KB

Download
memory/4664-18-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing