e13cb2d50e9530e1df831a22ed7c75843c1ffe37c1058a80e81c3b37295dddcd

Analysis

max time kernel
143s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 06:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-27_4541a93fb380b55079b99a073d97ea7d_cryptolocker.exe
Size

73KB
MD5

4541a93fb380b55079b99a073d97ea7d
SHA1

dd7006259c56db06cf48a954cbbc9398347e7695
SHA256

e13cb2d50e9530e1df831a22ed7c75843c1ffe37c1058a80e81c3b37295dddcd
SHA512

842f802bcdb797f69f8f046fe5edc33b3edad429df7cb56bf1a68346215f7349f1f2d60769d31ef59ba90fb0b94836bf9aa3906eddc144f8beeb564b9415747f
SSDEEP

768:u6LsoEEeegiZPvEhHSG+gZgtOOtEvwDpjeY10Y/YMs2:u6QFElP6n+gWMOtEvwDpjJGYQb2

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000002326a-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000002326a-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-05-27_4541a93fb380b55079b99a073d97ea7d_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2336	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2336	2748	2024-05-27_4541a93fb380b55079b99a073d97ea7d_cryptolocker.exe	91
PID 2748 wrote to memory of 2336	2748	2024-05-27_4541a93fb380b55079b99a073d97ea7d_cryptolocker.exe	91
PID 2748 wrote to memory of 2336	2748	2024-05-27_4541a93fb380b55079b99a073d97ea7d_cryptolocker.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-05-27_4541a93fb380b55079b99a073d97ea7d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-27_4541a93fb380b55079b99a073d97ea7d_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
74KB

MD5
d92e69640a53ac24a420749a42e48ba3

SHA1
147aca45f74e9743b084d25a58ab7545a0e6e669

SHA256
c50ed8fdaeb8c850df51f5072f95d0d6e990d28fcb3c30f0947f92751d3cceb3

SHA512
d068a40cab9d8fa8163815c7152a96648ae799a45f9a3dcc81df4bc34191c2494ea64b942522cc588f9c81f502c6358617f36b9375bd7f5874a5c8e948d81843

Download Submit
memory/2336-17-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/2336-23-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/2748-0-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2748-1-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2748-2-0x0000000000510000-0x0000000000516000-memory.dmp

Filesize
24KB

Download