6e6ac758cf0eb54d6423a3ccb6098903734df6977966bebcfc91482d6c3571b0

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-11_5d2b559d6d00ede1721abcf0aa91f837_cryptolocker.exe
Size

39KB
MD5

5d2b559d6d00ede1721abcf0aa91f837
SHA1

d75d2389807a7aba0062eaa50564cf66970106ad
SHA256

6e6ac758cf0eb54d6423a3ccb6098903734df6977966bebcfc91482d6c3571b0
SHA512

f7e7b18a823d05fe5c17ddf9be2f93d2998d46a640dd5bfcc5229adc02d4d8915fe0f77789af29c2093396e2f03e152151cc994b93ba6d46bc091929380efb3c
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDDw3sCu5b+rc52Da:bgGYcA/53GADw8ClrcI2

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	2024-01-11_5d2b559d6d00ede1721abcf0aa91f837_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	hasfj.exe

Executes dropped EXE 1 IoCs

pid	Process
3288	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 3288	1236	2024-01-11_5d2b559d6d00ede1721abcf0aa91f837_cryptolocker.exe	91
PID 1236 wrote to memory of 3288	1236	2024-01-11_5d2b559d6d00ede1721abcf0aa91f837_cryptolocker.exe	91
PID 1236 wrote to memory of 3288	1236	2024-01-11_5d2b559d6d00ede1721abcf0aa91f837_cryptolocker.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-01-11_5d2b559d6d00ede1721abcf0aa91f837_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-11_5d2b559d6d00ede1721abcf0aa91f837_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
39KB

MD5
906665382b750a43f44a8e1355bb212b

SHA1
826f2f47ff0e84fe679f5a8fbb5409d11d859fc4

SHA256
f769693349057917805059832b14fa853f06e481f62223666301b5a2c36c6143

SHA512
6a3939e32197b17408a13031f3a62e30e64c27159e5793d59c437f8374952f608989362886aa78e05fed49e080ea3cd4d699567ea2de33f65185b4b57413aee8

Download Submit
memory/1236-0-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/1236-1-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/1236-2-0x0000000002380000-0x0000000002386000-memory.dmp

Filesize
24KB

Download
memory/3288-17-0x0000000002ED0000-0x0000000002ED6000-memory.dmp

Filesize
24KB

Download
memory/3288-20-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download