509ad50cddd2a5642381c57c4ae4fa800ca508c968532d7299e8691991dc2c10

Analysis

max time kernel
0s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-01_a6216aa1a1cd6f1b286fcd26ac73594b_cryptolocker.exe
Size

30KB
MD5

a6216aa1a1cd6f1b286fcd26ac73594b
SHA1

19422828ba1110ace4821b8cb9d162914a308e08
SHA256

509ad50cddd2a5642381c57c4ae4fa800ca508c968532d7299e8691991dc2c10
SHA512

7cdb686d2e8ad6dac8a7fd7290482fd272a129b84df88a6f50400692eaed1a42dfdf5b59c9b712a86eeaed320f243bc4999bbd3cf5a3c64bb2f3d6430ad7ce1b
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUgIunIYvxF:bA74zYcgT/Ekd0ryfjPIunvvxF

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	2024-01-01_a6216aa1a1cd6f1b286fcd26ac73594b_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\2024-01-01_a6216aa1a1cd6f1b286fcd26ac73594b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-01_a6216aa1a1cd6f1b286fcd26ac73594b_cryptolocker.exe"
1⤵
- Checks computer location settings
PID:2984
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
18KB

MD5
940c8e941a6243286ae4005c4baeb1d7

SHA1
0c9134d5afced7c7e70723bce98b0a0e6a7444e7

SHA256
ab1d6d9cde4ca808c64856d60a3ca5b52b16524e2a965f283f2c9818ae1d1bd6

SHA512
10dcea29b0b0ce6423ea73f1e42f81b10b016e300b35b78ed6520ed840168aa88fd7bcd96a63b92aea0ccbb3dec2308ff8df67e60211c75404eb1866d05fc57e

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
30KB

MD5
ebd7ba5e2a3aa33d822f655b9d3f836b

SHA1
cf91c5a39a982fb0bb86adc5cc0a04f20b6270e7

SHA256
3aba53ff0641b8d43b074c039e5a77c9a404ffe8b1e9a2eb39dce10aeba0f716

SHA512
c868efa1e7cac35c3a84385e32b6c3fda6cb57a88e313670c23bdfc067d0fe29dafe7b2b26c09f5534fb04b5f4906385ed6b792f7f419ea2a04eeccd6d6be8ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
26KB

MD5
921c5dc99653986c4d845624b76b4425

SHA1
2d698b7bf20d30a33499010fbed3a284bffe0e96

SHA256
041c6c54a6a36e7d050956ee5b75baad4a1a5a45745c1474d3a25c1ea5010809

SHA512
852cd58406db4208f0bdf1a4e77ce07e0b13a72b06aff170958fd9ca50059a097698b0007aadc641bb58a9c780556f84236ec63c8354ff533a982afe724e3024

Download Submit
memory/1700-17-0x0000000002ED0000-0x0000000002ED6000-memory.dmp

Filesize
24KB

Download
memory/1700-19-0x00000000020A0000-0x00000000020A6000-memory.dmp

Filesize
24KB

Download
memory/2984-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/2984-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/2984-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download