4d726a711a1c3a01c98770d764220d610bc0d791ed7ddf2adaed8a46b73835f6

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-11_bfeac5f36dbdccca409f3030f14dfb0f_cryptolocker.exe
Size

74KB
MD5

bfeac5f36dbdccca409f3030f14dfb0f
SHA1

08d341b05dad1249485e3d57b24aaa0bb09aa57d
SHA256

4d726a711a1c3a01c98770d764220d610bc0d791ed7ddf2adaed8a46b73835f6
SHA512

cb01ed8ebacc4d8e3fbd48051ac9af52251a96b42b493a4f089730a41c3c7dd57cf7ef91bfdfeaecd8a379bb711c38e2c1fdf1b2a9459c62b37b978ce9d02084
SSDEEP

768:u6LsoEEeegiZPvEhHSG+gZgtOOtEvwDpjeY10Y/YMsPeWY:u6QFElP6n+gWMOtEvwDpjJGYQbfY

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000900000002351a-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000900000002351a-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	2024-06-11_bfeac5f36dbdccca409f3030f14dfb0f_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2552	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2552	3056	2024-06-11_bfeac5f36dbdccca409f3030f14dfb0f_cryptolocker.exe	89
PID 3056 wrote to memory of 2552	3056	2024-06-11_bfeac5f36dbdccca409f3030f14dfb0f_cryptolocker.exe	89
PID 3056 wrote to memory of 2552	3056	2024-06-11_bfeac5f36dbdccca409f3030f14dfb0f_cryptolocker.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-06-11_bfeac5f36dbdccca409f3030f14dfb0f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-11_bfeac5f36dbdccca409f3030f14dfb0f_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4180,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:8
1⤵
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
74KB

MD5
876cf8d4c9c12275e9e0dac9efa7add5

SHA1
527deb5190ede75266c04807fb9ff475e50219fc

SHA256
70b92941640e4636cb5d87e57d3d891218e1d7064ff370608da68fcca8da847b

SHA512
d83ffc974474e9b7b4b655efb7ec4dd168131da50a6b9ac2ac4a2a433780f8d902110e500f8a6b08047c8d01c4e287c4089adf569b7f3626e6611b869d612114

Download Submit
memory/2552-23-0x0000000002150000-0x0000000002156000-memory.dmp

Filesize
24KB

Download
memory/3056-0-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/3056-8-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/3056-1-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download