Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/06/2024, 05:18

General

  • Target

    2024-06-11_972bd06e3c368395753d289c1f752ce9_cryptolocker.exe

  • Size

    67KB

  • MD5

    972bd06e3c368395753d289c1f752ce9

  • SHA1

    bbf09004fc873b3cdddd813912c642fc886f5cf6

  • SHA256

    cb155054e8e605a6ea4966dc665c03f7a37f685be1eb62f69ec7c66559944a03

  • SHA512

    90131a4ff09e77006c4bd8275caf3f891259b58e82f373431d71ace482e05897a7d9922765e35a2551656c3e394b233c8ce25b322ecf074283311da4812ae99a

  • SSDEEP

    1536:V6QFElP6n+gMQMOtEvwDpjyaLccVCbmh85M:V6a+pOtEvwDpjvb

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-11_972bd06e3c368395753d289c1f752ce9_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-11_972bd06e3c368395753d289c1f752ce9_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:912
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:3524

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\asih.exe

          Filesize

          67KB

          MD5

          72601a3e83044e755e5cb811eecf2840

          SHA1

          8f536020f4c50bf1929871465cd1611d4281d858

          SHA256

          8e8de67f2e18697981223a8fc2fe31ede9da987af8372274d8e6d6418d8abdd5

          SHA512

          21f1926ab433f5bca564f05164b638f59b05bed48b4f67c1ff233573022a0190e0424ef8fede0d71319a9627557f4567fb4620b906da7115c6bdedf20b543bf4

        • memory/912-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

          Filesize

          24KB

        • memory/912-1-0x00000000004F0000-0x00000000004F6000-memory.dmp

          Filesize

          24KB

        • memory/912-8-0x00000000004D0000-0x00000000004D6000-memory.dmp

          Filesize

          24KB

        • memory/3524-17-0x0000000001F60000-0x0000000001F66000-memory.dmp

          Filesize

          24KB

        • memory/3524-18-0x0000000001F80000-0x0000000001F86000-memory.dmp

          Filesize

          24KB