51b1f973b919e953a29c1cc094fa95958bdf726eb2412c9eeb6475b1938bb8f6

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-11_5ef943aa61437fea009d7938a2c3dd27_cryptolocker.exe
Size

71KB
MD5

5ef943aa61437fea009d7938a2c3dd27
SHA1

38237ed7b23472f71cc1c21a0c543ab8177956f2
SHA256

51b1f973b919e953a29c1cc094fa95958bdf726eb2412c9eeb6475b1938bb8f6
SHA512

0414ea89398a933dd45bd203422828e0984bb99f3aad92294494e14226234444fa142cff0ee2272b06fe4d93b69285203a4153694a7ce9e23a1a873c60c1f865
SSDEEP

1536:quJu9cvMOtEvwDpjWYTjipvF2bx1PQALk:78SEOtEvwDpjWYvQd2Po

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/2252-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x0008000000023259-13.dat	CryptoLocker_rule2
behavioral2/memory/2252-25-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/4120-26-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral2/memory/2252-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x0008000000023259-13.dat	CryptoLocker_set1
behavioral2/memory/2252-25-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral2/memory/4120-26-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/2252-0-0x0000000000500000-0x000000000050F000-memory.dmp	UPX
behavioral2/files/0x0008000000023259-13.dat	UPX
behavioral2/memory/2252-25-0x0000000000500000-0x000000000050F000-memory.dmp	UPX
behavioral2/memory/4120-26-0x0000000000500000-0x000000000050F000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-06-11_5ef943aa61437fea009d7938a2c3dd27_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4120	asih.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2252-0-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/files/0x0008000000023259-13.dat	upx
behavioral2/memory/2252-25-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/memory/4120-26-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 4120	2252	2024-06-11_5ef943aa61437fea009d7938a2c3dd27_cryptolocker.exe	91
PID 2252 wrote to memory of 4120	2252	2024-06-11_5ef943aa61437fea009d7938a2c3dd27_cryptolocker.exe	91
PID 2252 wrote to memory of 4120	2252	2024-06-11_5ef943aa61437fea009d7938a2c3dd27_cryptolocker.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-06-11_5ef943aa61437fea009d7938a2c3dd27_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-11_5ef943aa61437fea009d7938a2c3dd27_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3936 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
71KB

MD5
1ede68f6f1c6c23601848a3336727397

SHA1
91cf0b8f9178d01d2da565410652ad8ad359845a

SHA256
5843aef178fad9e0746239fe603bfa63e7b525432970cfd49e7dc97fdce5a9c7

SHA512
6a1ed91dd62348ef4786aea17064d160dc8200ec8c89337ac05d5056ea02d3bddd47aa562512157065760fc061942410b75311d34a8e49102d084fdccaf0c722

Download Submit
memory/2252-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2252-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2252-2-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2252-3-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/2252-25-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4120-26-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download