Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2024, 15:25

General

  • Target

    2024-05-31_038f624ec719ef7249d943f1eaddcf1e_cryptolocker.exe

  • Size

    49KB

  • MD5

    038f624ec719ef7249d943f1eaddcf1e

  • SHA1

    ba1e358f1ae64cb8e49f6ebcae939dc924dd6770

  • SHA256

    c6664951962325b445189b178c59a5af0ba0af4096d9cbcb81acf90619b515b8

  • SHA512

    1a8c0dba4cb2e911f6e7cf27dc913d70556a3ac4bd7e5795f166bb196dffcc028484047ff92df8f3ff71455d5f8c44b383e020c82308cc161648f84266cb9ffc

  • SSDEEP

    768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vdXfN:X6QFElP6n+gJBMOtEvwDpjBtEdXfN

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-31_038f624ec719ef7249d943f1eaddcf1e_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-31_038f624ec719ef7249d943f1eaddcf1e_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1336
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:1860

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\asih.exe

          Filesize

          49KB

          MD5

          41111690336ac1c727fa504170b83ca9

          SHA1

          a2f3e074a1f16b7448df1bc2c5a98e6d1bf51d17

          SHA256

          a870aa04cffb7a957aab99c8eab82bbe6f071d4b065ec9b736ee3ed5d5eb26c1

          SHA512

          dbb2496e4f53eebd56e39832dd4aedf05d33fd755fa0c99c35b7492c2afc613b02b80a8268b70003f7105b778e194e3b8a36f8b8af7cda395a29a003dd23e1d8

        • memory/1336-8-0x00000000004E0000-0x00000000004E6000-memory.dmp

          Filesize

          24KB

        • memory/1336-1-0x00000000005F0000-0x00000000005F6000-memory.dmp

          Filesize

          24KB

        • memory/1336-0-0x00000000004E0000-0x00000000004E6000-memory.dmp

          Filesize

          24KB

        • memory/1860-17-0x00000000004F0000-0x00000000004F6000-memory.dmp

          Filesize

          24KB

        • memory/1860-23-0x00000000004D0000-0x00000000004D6000-memory.dmp

          Filesize

          24KB