489a627e0ae8d8e7393f1f6947b9a16ea41b3b90c7388e0ca842a42ab9717afc

Analysis

max time kernel
0s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2024 05:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-09_a6db6616f12e2f03ea6f7cb6fc5cdd95_cryptolocker.exe
Size

44KB
MD5

a6db6616f12e2f03ea6f7cb6fc5cdd95
SHA1

f05d650f3af17f314b39fa9f806070518d823c69
SHA256

489a627e0ae8d8e7393f1f6947b9a16ea41b3b90c7388e0ca842a42ab9717afc
SHA512

76bd73cc16cb6c6a51ca9ed27e6a1568af3cb3873434746e5e59deff0887158ac5ac568f81379103463dd41051c5f18cac1bac7c43c5417c63ec28e630610c8d
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37YbDu5z/hrJ:bgGYcA/53GAA6y37nbrJ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	2024-01-09_a6db6616f12e2f03ea6f7cb6fc5cdd95_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2716	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 2716	908	2024-01-09_a6db6616f12e2f03ea6f7cb6fc5cdd95_cryptolocker.exe	21
PID 908 wrote to memory of 2716	908	2024-01-09_a6db6616f12e2f03ea6f7cb6fc5cdd95_cryptolocker.exe	21
PID 908 wrote to memory of 2716	908	2024-01-09_a6db6616f12e2f03ea6f7cb6fc5cdd95_cryptolocker.exe	21

C:\Users\Admin\AppData\Local\Temp\2024-01-09_a6db6616f12e2f03ea6f7cb6fc5cdd95_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-09_a6db6616f12e2f03ea6f7cb6fc5cdd95_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:908
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
45KB

MD5
167ce8cc24981cfb15db86f74114e154

SHA1
caf9fbe1997366f21f81365253a3d49a4ec22cd7

SHA256
ab8213f6d94d955e015790a62c0f341b8cdbc03ff0e7b41fdf0fff0c3e192a91

SHA512
7d34ece150d2340c4cf51b3a315f0ef9540b3a2645713086680633ce5b69627065e35c23cea8970be51c4b68bb2b7e9499cfd7fb51147fc74a9bb48b718e166f

Download Submit
memory/908-2-0x0000000002310000-0x0000000002316000-memory.dmp

Filesize
24KB

Download
memory/908-1-0x0000000002260000-0x0000000002266000-memory.dmp

Filesize
24KB

Download
memory/908-0-0x0000000002260000-0x0000000002266000-memory.dmp

Filesize
24KB

Download
memory/2716-17-0x0000000002380000-0x0000000002386000-memory.dmp

Filesize
24KB

Download
memory/2716-23-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download