02ade50ca765b4d734ba94088ebe6c5ee5ffe0e77503040961330208f59f3c23

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-03_78ef9eda0250340e7456a5e6d360a763_cryptolocker.exe
Size

46KB
MD5

78ef9eda0250340e7456a5e6d360a763
SHA1

9c9a9e76c4dd8325231f4933d11ff72160eb69ff
SHA256

02ade50ca765b4d734ba94088ebe6c5ee5ffe0e77503040961330208f59f3c23
SHA512

735e63a083051539352742bf58289f7607fb275c0017699a1d2836985f923682fc2aa4d1c48d6a1a73e1d71edc250ac29315612affd55cb208ddde734eaef858
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBVaD3TP7DFHuRcD9V:X6QFElP6n+gJQMOtEvwDpjBmzDkWDv

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000b00000002339a-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000b00000002339a-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	2024-06-03_78ef9eda0250340e7456a5e6d360a763_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
728	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 728	4600	2024-06-03_78ef9eda0250340e7456a5e6d360a763_cryptolocker.exe	84
PID 4600 wrote to memory of 728	4600	2024-06-03_78ef9eda0250340e7456a5e6d360a763_cryptolocker.exe	84
PID 4600 wrote to memory of 728	4600	2024-06-03_78ef9eda0250340e7456a5e6d360a763_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-06-03_78ef9eda0250340e7456a5e6d360a763_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_78ef9eda0250340e7456a5e6d360a763_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
46KB

MD5
493ce783cac27fa80a6b13e4404b33b8

SHA1
68cafaaea9702f34e4de5a7eb5fc17ecfa440791

SHA256
91f9aa68db235c128723ec8b35954071d5fe1c047fcf6869bd8c08fde3c1e3ca

SHA512
b47dfdecb4083ef0f0124b3425b2ac4a0008a477602714ade800d9914b1342f2f6f7244387db7361a0524d2af46dc678525239548a98db2b66fbe3b458159989

Download Submit
memory/728-17-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/728-18-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/4600-0-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/4600-1-0x0000000002110000-0x0000000002116000-memory.dmp

Filesize
24KB

Download
memory/4600-8-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download