Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2024, 23:09

General

  • Target

    2024-06-02_58f4c7e33ffbef347607ecf1dbe9902c_cryptolocker.exe

  • Size

    47KB

  • MD5

    58f4c7e33ffbef347607ecf1dbe9902c

  • SHA1

    a889a5587bfac2491f69a36a5830f63fdadd4a70

  • SHA256

    c5eca73b2d41e179057e0ee240edf4d4801449c24c15d05081dd514b0208eb12

  • SHA512

    2c29bf76d1155baa36b0f75438ae7ae6d5ce24b87b59754059af26e36317be710b4583ebe4d0dcbface888c7b88908728c05adf051e50015291a0d58221ee914

  • SSDEEP

    768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/DpkcU:P6Q0ElP6G+gJQMOtEvwDpjB8WMlfU

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-02_58f4c7e33ffbef347607ecf1dbe9902c_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-02_58f4c7e33ffbef347607ecf1dbe9902c_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1040
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:1624

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\asih.exe

          Filesize

          48KB

          MD5

          a213790a338b42761bc10f0811cac32e

          SHA1

          e51621858dbc1a4895d663fb27bf5fea540df19b

          SHA256

          c1b30fe057607588b0bc8ece7c925f29e832c6e832001b9768f1658fd1a3e251

          SHA512

          6c83b6414a3cda7da4e2648c82e410ba241bb1d83ee32570ebba5b49f060df4fd963484addf03a94b54a98a559f4a72a3c319f7d4178e69650bda2b20ae9bac5

        • memory/1040-0-0x0000000000500000-0x000000000050B000-memory.dmp

          Filesize

          44KB

        • memory/1040-1-0x00000000005B0000-0x00000000005B6000-memory.dmp

          Filesize

          24KB

        • memory/1040-5-0x00000000006D0000-0x00000000006D6000-memory.dmp

          Filesize

          24KB

        • memory/1040-9-0x00000000005B0000-0x00000000005B6000-memory.dmp

          Filesize

          24KB

        • memory/1040-17-0x0000000000500000-0x000000000050B000-memory.dmp

          Filesize

          44KB

        • memory/1624-18-0x0000000000500000-0x000000000050B000-memory.dmp

          Filesize

          44KB

        • memory/1624-21-0x0000000002100000-0x0000000002106000-memory.dmp

          Filesize

          24KB

        • memory/1624-20-0x0000000000740000-0x0000000000746000-memory.dmp

          Filesize

          24KB

        • memory/1624-27-0x0000000000500000-0x000000000050B000-memory.dmp

          Filesize

          44KB