af62efee8373da9e273840da89bdba657f418525877e0d1a6daeef2643205e80

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-15_3710f1e0559162a1c9209f0d35b1ffa2_cryptolocker.exe
Size

42KB
MD5

3710f1e0559162a1c9209f0d35b1ffa2
SHA1

ff3c2b11bb62bf626d9ce0ebca3bc4a7852894a4
SHA256

af62efee8373da9e273840da89bdba657f418525877e0d1a6daeef2643205e80
SHA512

4b4427f01f26f0e2aefa382bff53072fc68dff59390dfd636abdcbd9584b714b173c1140d4221169d6617809ecfec99cdd963411d8c9540fda17dc6ae8a99dc7
SSDEEP

768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkL7vF1Tw:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkLw

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/4364-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x00090000000233fa-13.dat	CryptoLocker_rule2
behavioral2/memory/3168-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/4364-18-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral2/memory/4364-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x00090000000233fa-13.dat	CryptoLocker_set1
behavioral2/memory/3168-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral2/memory/4364-18-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	2024-06-15_3710f1e0559162a1c9209f0d35b1ffa2_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3168	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 3168	4364	2024-06-15_3710f1e0559162a1c9209f0d35b1ffa2_cryptolocker.exe	81
PID 4364 wrote to memory of 3168	4364	2024-06-15_3710f1e0559162a1c9209f0d35b1ffa2_cryptolocker.exe	81
PID 4364 wrote to memory of 3168	4364	2024-06-15_3710f1e0559162a1c9209f0d35b1ffa2_cryptolocker.exe	81

C:\Users\Admin\AppData\Local\Temp\2024-06-15_3710f1e0559162a1c9209f0d35b1ffa2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-15_3710f1e0559162a1c9209f0d35b1ffa2_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
43KB

MD5
ae3316a6c73815e841c3a2f6ee01f5ed

SHA1
ed813b6d03df6217c9341254a9ad09181da8e914

SHA256
6026654ab10cca462939ede80b249df8d78fc221552c9611ffd692b31cac3a8f

SHA512
56c58b5f5a77341f1adb690a4d624c78d32a09315b42938b2def83a71655a8b8430414cf770a73368cbc8a220554a8f27c3c562a14cbcb31171d07c96019a429

Download Submit
memory/3168-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/4364-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/4364-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4364-2-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/4364-9-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4364-18-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download