5c49c19a2738ffe430ee00bcadece77cba67ef215d738285b02f94b7754569e6

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-28_7c692d44fdd0ada5f84366ea8d242215_cryptolocker.exe
Size

47KB
MD5

7c692d44fdd0ada5f84366ea8d242215
SHA1

6f8650bb61fa0a00f5c0a46255da8c5f87ef44d3
SHA256

5c49c19a2738ffe430ee00bcadece77cba67ef215d738285b02f94b7754569e6
SHA512

8c7e34afc4253d083a00561e88bda8f57aecc054280bae8d7c08d1f436a231b8556b640c10fd2b5eef33f42162f51a867b332383e9d12c5aa084838b2abd1f77
SSDEEP

384:e/4wODQkzonAYsju5N/surDQtOOtEvwDpjqIGROqS/WccJVJwi2B5oCCM8CLW2Vs:79inqyNR/QtOOtEvwDpjBKccJVODvy31

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/4516-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x0008000000023285-13.dat	CryptoLocker_rule2
behavioral2/memory/4276-18-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/4516-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral2/memory/4516-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x0008000000023285-13.dat	CryptoLocker_set1
behavioral2/memory/4276-18-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral2/memory/4516-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	2024-05-28_7c692d44fdd0ada5f84366ea8d242215_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4276	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 4276	4516	2024-05-28_7c692d44fdd0ada5f84366ea8d242215_cryptolocker.exe	81
PID 4516 wrote to memory of 4276	4516	2024-05-28_7c692d44fdd0ada5f84366ea8d242215_cryptolocker.exe	81
PID 4516 wrote to memory of 4276	4516	2024-05-28_7c692d44fdd0ada5f84366ea8d242215_cryptolocker.exe	81

C:\Users\Admin\AppData\Local\Temp\2024-05-28_7c692d44fdd0ada5f84366ea8d242215_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-28_7c692d44fdd0ada5f84366ea8d242215_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
47KB

MD5
84f3fd07305823a625e8d343e401103f

SHA1
59999999924cd64a9d80184e5b4478d64d600586

SHA256
82da2734ce31c34789ccefa6fe135cc951067df27dde5e43e1b3a85ec4cf6fef

SHA512
76594c99bf66fb6f81008adcf06d3dda57f6c008a5d332c7b55ee84da7437ea64726869127e8923963972f09c936a5548ec826831eef9cec0ab08c04d0899bd6

Download Submit
memory/4276-18-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4276-20-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/4276-26-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4516-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4516-1-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/4516-2-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/4516-9-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/4516-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download