38b792be7521665547e9fb933fee5a9ebbd8e2663bcb46575594e2bff31e82a4

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_214afdbac15a26a76b2786a474ef50d3_cryptolocker.exe
Size

30KB
MD5

214afdbac15a26a76b2786a474ef50d3
SHA1

a653d64ae39002d2f8e76e45b19a977c46b65beb
SHA256

38b792be7521665547e9fb933fee5a9ebbd8e2663bcb46575594e2bff31e82a4
SHA512

3dfc932de4707376df1f84ce177b4ab95c4c9d170a0ac42a469a66b7d1592a657978190bea83912b55b780acca962d9c35ec77fe8c210cc1e13cc30ac37e3949
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUgIunvsa:bA74zYcgT/Ekd0ryfjPIunvsa

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023225-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	2024-01-25_214afdbac15a26a76b2786a474ef50d3_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2476	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 2476	5028	2024-01-25_214afdbac15a26a76b2786a474ef50d3_cryptolocker.exe	88
PID 5028 wrote to memory of 2476	5028	2024-01-25_214afdbac15a26a76b2786a474ef50d3_cryptolocker.exe	88
PID 5028 wrote to memory of 2476	5028	2024-01-25_214afdbac15a26a76b2786a474ef50d3_cryptolocker.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-01-25_214afdbac15a26a76b2786a474ef50d3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_214afdbac15a26a76b2786a474ef50d3_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
30KB

MD5
d10e2055f261e6e1bdb64acfd352a00b

SHA1
ff53e7e8cee1ec53d465ed7deee3e74888d75258

SHA256
deedf5f253fd90d5770bb3929bdc964e4fc576b7bccec9a04721d65188efbf00

SHA512
a06c62104bb07c016a6b74d3031e91da0b3e660d7125dad25f270fab32788ab23416c95f6c55529e2a13cc743e8cde462fb88bb9ac75ac2dab5bdb46b3046c34

Download Submit
memory/2476-18-0x0000000002120000-0x0000000002126000-memory.dmp

Filesize
24KB

Download
memory/2476-17-0x0000000002ED0000-0x0000000002ED6000-memory.dmp

Filesize
24KB

Download
memory/5028-0-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/5028-1-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/5028-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download