09f2c14bdb5b5a742320670c466466a19fa3dc95d9036d1ff7431879a9f9f5e7

Analysis

max time kernel
154s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
23/10/2023, 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2023-09-07_df250ce1a54d9cf4ed1baa8908ad4f09_cryptolocker_JC.exe
Size

40KB
MD5

df250ce1a54d9cf4ed1baa8908ad4f09
SHA1

c0e861146e521df93f62058886b2a017c69825cb
SHA256

09f2c14bdb5b5a742320670c466466a19fa3dc95d9036d1ff7431879a9f9f5e7
SHA512

0a4da9648812c935f854244c242695eed0c7216058be1eadbb0330322ed052e58166b51bdc76c1981428b0e722ec62f45c287eeb596175f05dc109969e393081
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37Yb6:bgGYcA/53GAA6y37H

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	NEAS.2023-09-07_df250ce1a54d9cf4ed1baa8908ad4f09_cryptolocker_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
1500	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 1500	1888	NEAS.2023-09-07_df250ce1a54d9cf4ed1baa8908ad4f09_cryptolocker_JC.exe	84
PID 1888 wrote to memory of 1500	1888	NEAS.2023-09-07_df250ce1a54d9cf4ed1baa8908ad4f09_cryptolocker_JC.exe	84
PID 1888 wrote to memory of 1500	1888	NEAS.2023-09-07_df250ce1a54d9cf4ed1baa8908ad4f09_cryptolocker_JC.exe	84

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-07_df250ce1a54d9cf4ed1baa8908ad4f09_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-07_df250ce1a54d9cf4ed1baa8908ad4f09_cryptolocker_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
40KB

MD5
f2f18e02776ead7c0f88fcc17c47183c

SHA1
d46b12b0d4ffa87a23ff56a8f500db4a2f05ad05

SHA256
4b4208fc5914f0f79f17a9b74064843249bf88ea02bda6e88e34809b3783d96e

SHA512
3ee32eed16b51a12dbd28ca7026b5a6b297673a1998acc1550b26242dfb892d0cc2c14c8c3fb1227184edfb09af44bcd367958b78795129fb98873525f9eac2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
40KB

MD5
f2f18e02776ead7c0f88fcc17c47183c

SHA1
d46b12b0d4ffa87a23ff56a8f500db4a2f05ad05

SHA256
4b4208fc5914f0f79f17a9b74064843249bf88ea02bda6e88e34809b3783d96e

SHA512
3ee32eed16b51a12dbd28ca7026b5a6b297673a1998acc1550b26242dfb892d0cc2c14c8c3fb1227184edfb09af44bcd367958b78795129fb98873525f9eac2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
40KB

MD5
f2f18e02776ead7c0f88fcc17c47183c

SHA1
d46b12b0d4ffa87a23ff56a8f500db4a2f05ad05

SHA256
4b4208fc5914f0f79f17a9b74064843249bf88ea02bda6e88e34809b3783d96e

SHA512
3ee32eed16b51a12dbd28ca7026b5a6b297673a1998acc1550b26242dfb892d0cc2c14c8c3fb1227184edfb09af44bcd367958b78795129fb98873525f9eac2c

Download Submit
memory/1500-17-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/1500-18-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/1888-0-0x0000000002180000-0x0000000002186000-memory.dmp

Filesize
24KB

Download
memory/1888-1-0x0000000002180000-0x0000000002186000-memory.dmp

Filesize
24KB

Download
memory/1888-2-0x0000000002300000-0x0000000002306000-memory.dmp

Filesize
24KB

Download