c905576509ae01d874a0d2db6fdc6aacfc0b5e551fa1c7653540013b99218b69

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 20:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-05-29_def493811af6a8e009fdff5ae7b2bdad_cryptolocker.exe
Size

87KB
MD5

def493811af6a8e009fdff5ae7b2bdad
SHA1

8d7ab08519ccf3332898653af4c5147f2a9ff0d8
SHA256

c905576509ae01d874a0d2db6fdc6aacfc0b5e551fa1c7653540013b99218b69
SHA512

36684b5910100ba67e9c9997a958099939c0c61a662b93676377f249796f989784a7dd3b793fe594517f895b4ebe6a22bceeecd5ba4e05e41a8706bb55fa94ec
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjyaLccVNl6aF:V6a+pOtEvwDpjvph

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00090000000233c1-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x00090000000233c1-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	2024-05-29_def493811af6a8e009fdff5ae7b2bdad_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2316	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 2316	4892	2024-05-29_def493811af6a8e009fdff5ae7b2bdad_cryptolocker.exe	83
PID 4892 wrote to memory of 2316	4892	2024-05-29_def493811af6a8e009fdff5ae7b2bdad_cryptolocker.exe	83
PID 4892 wrote to memory of 2316	4892	2024-05-29_def493811af6a8e009fdff5ae7b2bdad_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-05-29_def493811af6a8e009fdff5ae7b2bdad_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-29_def493811af6a8e009fdff5ae7b2bdad_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
87KB

MD5
a60f1a6b84affd0da67bc9a916801466

SHA1
f3f160952c0a735da43e5d152282e2b1750b5131

SHA256
d84400d40897541dbebf530aff3feb4a180c68b1d2c087518eaf753d0fbf519b

SHA512
43e5aef494adfdddebf8155c6d653600d87818b3652d55de4199cc72feb074ee0e0a92de9ac72bb68a5a4da3e2c092538012bef2e472a69fe0aa7aaaab59e46c

Download Submit
memory/2316-17-0x0000000001FF0000-0x0000000001FF6000-memory.dmp

Filesize
24KB

Download
memory/2316-23-0x0000000001FD0000-0x0000000001FD6000-memory.dmp

Filesize
24KB

Download
memory/4892-0-0x0000000002140000-0x0000000002146000-memory.dmp

Filesize
24KB

Download
memory/4892-1-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/4892-8-0x0000000002140000-0x0000000002146000-memory.dmp

Filesize
24KB

Download