1eb208e54773a40a3d10cfa6bf97f0e89c5210e5ebf3ec2afe85613f5b6e2644

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-27_36fc40f625073cf01eae86e0681043db_cryptolocker.exe
Size

96KB
MD5

36fc40f625073cf01eae86e0681043db
SHA1

a3d6051c5ea981c520de3b5350469dd230526312
SHA256

1eb208e54773a40a3d10cfa6bf97f0e89c5210e5ebf3ec2afe85613f5b6e2644
SHA512

39721507171d9142f734d41be0c6529495ce9929cd7b360d2cbe22a5b7441074a0cc036523225930ba5ac229132e5fa6a6756f1a6c108d2574da0ca1ff8d4935
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwNgp0E:V6a+pOtEvwDpjtzM

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000232a4-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000232a4-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	2024-05-27_36fc40f625073cf01eae86e0681043db_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4156	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 4156	3420	2024-05-27_36fc40f625073cf01eae86e0681043db_cryptolocker.exe	82
PID 3420 wrote to memory of 4156	3420	2024-05-27_36fc40f625073cf01eae86e0681043db_cryptolocker.exe	82
PID 3420 wrote to memory of 4156	3420	2024-05-27_36fc40f625073cf01eae86e0681043db_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-05-27_36fc40f625073cf01eae86e0681043db_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-27_36fc40f625073cf01eae86e0681043db_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
96KB

MD5
8c9b7b8580990b90d8be37a1bc544567

SHA1
6ecccb7254a91d1e5944c4f2e6b73d09a90db1b6

SHA256
ff0fdb3bc947180e6234b9a24bd5a6fe9a71284b11b473536d5a12fe0d2513ad

SHA512
40e3618917bc56037f5069ac523aa440c45ef4d219edddbe4e1fa08792c88fc0594ad4078000cabb7ec6c7928a836784f896f1a299dbe8a821d436632d44ef74

Download Submit
memory/3420-0-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/3420-1-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/3420-7-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/4156-17-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/4156-18-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download