2451ca3ffe42ca2123b38140197f5a02cce7cbaca50eab5febc9fcb114566b38

Analysis

max time kernel
143s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 00:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-29_949aa091459ef3a23fba118acedf5ecf_cryptolocker.exe
Size

43KB
MD5

949aa091459ef3a23fba118acedf5ecf
SHA1

fec8d7e09b35a2f07d6fb416cd5bec554d637224
SHA256

2451ca3ffe42ca2123b38140197f5a02cce7cbaca50eab5febc9fcb114566b38
SHA512

6a565cf5f5828d708a250d3216b16f9582a5a8802e31e39361da02ad01eb6013c8cde60b4d222eda3b6c072090b4d7238948c9cbb53b5719c5977833dcaadd93
SSDEEP

768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkL7vF1Tq:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkLq

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 3 IoCs

resource	yara_rule
behavioral2/memory/4416-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x000e000000023240-13.dat	CryptoLocker_rule2
behavioral2/memory/4416-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 3 IoCs

resource	yara_rule
behavioral2/memory/4416-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x000e000000023240-13.dat	CryptoLocker_set1
behavioral2/memory/4416-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-06-29_949aa091459ef3a23fba118acedf5ecf_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4696	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 4696	4416	2024-06-29_949aa091459ef3a23fba118acedf5ecf_cryptolocker.exe	91
PID 4416 wrote to memory of 4696	4416	2024-06-29_949aa091459ef3a23fba118acedf5ecf_cryptolocker.exe	91
PID 4416 wrote to memory of 4696	4416	2024-06-29_949aa091459ef3a23fba118acedf5ecf_cryptolocker.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-06-29_949aa091459ef3a23fba118acedf5ecf_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-29_949aa091459ef3a23fba118acedf5ecf_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4440 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:5040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
44KB

MD5
1beeadda51eb42dc305389ee8e9698ed

SHA1
b67efd2925116993e74803cc33606c0edcb75fc5

SHA256
b92b16ada469e4da8e9ceae32a49ad678c344dff08d662b77c81f0b55e5740b2

SHA512
7ff25a7cd68b2a3db016fb1d52b47df9c5bc3d56276a6bcc3dbdbcc0bdc944973c268b193f29a46c3351d50c857dbb0e0ec3454758250176032525bd2371e6e5

Download Submit
memory/4416-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/4416-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4416-2-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4416-3-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/4416-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/4696-19-0x0000000002060000-0x0000000002066000-memory.dmp

Filesize
24KB

Download
memory/4696-25-0x00000000021C0000-0x00000000021C6000-memory.dmp

Filesize
24KB

Download