Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 04:50
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-02_ea33fe4831c0577b2dba0c352a4d94ed_cryptolocker.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-02_ea33fe4831c0577b2dba0c352a4d94ed_cryptolocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-02_ea33fe4831c0577b2dba0c352a4d94ed_cryptolocker.exe
-
Size
51KB
-
MD5
ea33fe4831c0577b2dba0c352a4d94ed
-
SHA1
0ba562dc75a5afac452ded355bb2a3da1783f439
-
SHA256
0a1495479f90096b1e635dfc020cf14cff905f43e6e65d7889d07786d24047e1
-
SHA512
d390278d455f9c4f850aeea5edffc426c07695ea99060ff25f644893712efb84614952b4811d50812d2d6d24f3afe7699bf1f5e519d7414a675edb2bc4cf5d90
-
SSDEEP
1536:X6QFElP6n+gJQMOtEvwDpjB0GIWiWLqv3:X6a+SOtEvwDpjBe
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral2/files/0x0006000000023298-12.dat CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
resource yara_rule behavioral2/files/0x0006000000023298-12.dat CryptoLocker_set1 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 2024-06-02_ea33fe4831c0577b2dba0c352a4d94ed_cryptolocker.exe -
Executes dropped EXE 1 IoCs
pid Process 3552 asih.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4144 wrote to memory of 3552 4144 2024-06-02_ea33fe4831c0577b2dba0c352a4d94ed_cryptolocker.exe 81 PID 4144 wrote to memory of 3552 4144 2024-06-02_ea33fe4831c0577b2dba0c352a4d94ed_cryptolocker.exe 81 PID 4144 wrote to memory of 3552 4144 2024-06-02_ea33fe4831c0577b2dba0c352a4d94ed_cryptolocker.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_ea33fe4831c0577b2dba0c352a4d94ed_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_ea33fe4831c0577b2dba0c352a4d94ed_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:3552
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD545d87c91c5862b30e895eec717439a19
SHA1974cbf622ceb80d216d6943580b09ffa40e99c8e
SHA2568890355c3b368a662bf2fd5e988fc2871fb3826b9ff331ad66df86160a97b4ff
SHA512b74d95a32c1d0de2270159bf8e49cbeaa439eba51bfee1bc4cbd7de907f6e9bca138c7fdedc78145b3eb4c350e59a2d487341d403527dc28d50d425eb808321b