ed449ba6484b702f2afa6499fafb19570d8269f6f8458408798fdfe2042f7efc

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 11:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-04_601337fcdb298b39d0186bd6f38dee9f_cryptolocker.exe
Size

44KB
MD5

601337fcdb298b39d0186bd6f38dee9f
SHA1

c2205083fb7e96c683226ec7d2fca87ea17c7f3b
SHA256

ed449ba6484b702f2afa6499fafb19570d8269f6f8458408798fdfe2042f7efc
SHA512

30fde33388177625f0c631fd377b2119eab32805b352560e3de56a43cc3f7d90ea9f2ff549910092049d1012aec5d018dd16026c871a3120bfa3b4d6070ef3a7
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBVaD3TP7DFHuRcD9Hk2:X6QFElP6n+gJQMOtEvwDpjBmzDkWDtb

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00090000000233f9-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x00090000000233f9-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	2024-06-04_601337fcdb298b39d0186bd6f38dee9f_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
764	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 764	3416	2024-06-04_601337fcdb298b39d0186bd6f38dee9f_cryptolocker.exe	82
PID 3416 wrote to memory of 764	3416	2024-06-04_601337fcdb298b39d0186bd6f38dee9f_cryptolocker.exe	82
PID 3416 wrote to memory of 764	3416	2024-06-04_601337fcdb298b39d0186bd6f38dee9f_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-06-04_601337fcdb298b39d0186bd6f38dee9f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-04_601337fcdb298b39d0186bd6f38dee9f_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
44KB

MD5
0a9bec2215d338c92f26aa4085c26bb9

SHA1
e255510ad5877df897f4956d1b4fd533e0297da6

SHA256
417a373437bc193346575044764f32ac533e31fb83437c5ac61c64e3b68b0f3b

SHA512
c5824eae86f10eeb36f644b7f5e9f44ba085127d0d887740c8e6a442142f946e08c9a293b7a4478b6b77d2e1696811165d8a5b2cbc110e57701233aea26ff441

Download Submit
memory/3416-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/3416-1-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/3416-8-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download