Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 05:22
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-02_47cab6f2c0e4d1d29203172259c924e1_cryptolocker.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-02_47cab6f2c0e4d1d29203172259c924e1_cryptolocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-02_47cab6f2c0e4d1d29203172259c924e1_cryptolocker.exe
-
Size
74KB
-
MD5
47cab6f2c0e4d1d29203172259c924e1
-
SHA1
5c827e5263cf85854c6e76e5e096e2a3c3a1db9f
-
SHA256
868045b1eb3aa11dd01ad4e46d7b424782a717475b73abe046953cf583122270
-
SHA512
19968fd8804dfe2fd3a5054db7670ea0c42274da0037e7668354d2110eb2c4e27de763058ce38e9b355e5460443ebc840674a61846dce08f84d5d1c5f32496f7
-
SSDEEP
768:u6LsoEEeegiZPvEhHSG+gZgtOOtEvwDpjeY10Y/YMsY:u6QFElP6n+gWMOtEvwDpjJGYQbY
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral2/files/0x0009000000023435-12.dat CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
resource yara_rule behavioral2/files/0x0009000000023435-12.dat CryptoLocker_set1 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation 2024-06-02_47cab6f2c0e4d1d29203172259c924e1_cryptolocker.exe -
Executes dropped EXE 1 IoCs
pid Process 1068 asih.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1436 wrote to memory of 1068 1436 2024-06-02_47cab6f2c0e4d1d29203172259c924e1_cryptolocker.exe 82 PID 1436 wrote to memory of 1068 1436 2024-06-02_47cab6f2c0e4d1d29203172259c924e1_cryptolocker.exe 82 PID 1436 wrote to memory of 1068 1436 2024-06-02_47cab6f2c0e4d1d29203172259c924e1_cryptolocker.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_47cab6f2c0e4d1d29203172259c924e1_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_47cab6f2c0e4d1d29203172259c924e1_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:1068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5d477449fe60aaca20454fa3b9ee9cc95
SHA13696fc2b42162cdac71cb43fe04c46f539ff5cc8
SHA256a814e2acab4a8572dc9c0280f7f4cf3782028daf061bf025bb3f1151f41456e0
SHA51231b40c535467b11b4540df0bf8369adc947da3f61dfc8a205c88c19dddb80530baf3758ab06f59f8a164317097875e091e8a5074f8c6b3ae87ff8f981aaa8d45