fab99cb387a7e1fa108fec33881be1245a97aadd2a7803af3b1637c0cf6cf6d5

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-28_de1915c2f2e24033ca3afb0d02b8ba1b_cryptolocker.exe
Size

33KB
MD5

de1915c2f2e24033ca3afb0d02b8ba1b
SHA1

a39ccb7776b39dd9b50da57f2cbba58d95674585
SHA256

fab99cb387a7e1fa108fec33881be1245a97aadd2a7803af3b1637c0cf6cf6d5
SHA512

d118df8f59cb97c9ae1fc1f239013d6dd0270274aff747ca321d843bc338847561b4620cdee4358886573772ea26d13be0a7f7492f6116fda01495a0ee2eb001
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUqMV6U8zKvGaLg+:bA74zYcgT/Ekd0ryfj86U8zbQ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023221-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	2024-01-28_de1915c2f2e24033ca3afb0d02b8ba1b_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
872	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 872	1204	2024-01-28_de1915c2f2e24033ca3afb0d02b8ba1b_cryptolocker.exe	89
PID 1204 wrote to memory of 872	1204	2024-01-28_de1915c2f2e24033ca3afb0d02b8ba1b_cryptolocker.exe	89
PID 1204 wrote to memory of 872	1204	2024-01-28_de1915c2f2e24033ca3afb0d02b8ba1b_cryptolocker.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-01-28_de1915c2f2e24033ca3afb0d02b8ba1b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-28_de1915c2f2e24033ca3afb0d02b8ba1b_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
34KB

MD5
16d7e439599b05ab93bc41b9c193f992

SHA1
da8749861251a5328805dbacb541048504b92454

SHA256
e67b01ffa167b78c5f3b2385154a5f5ac3e19b1f3fa52203d65fb3026d92e6a4

SHA512
bbf3e5952749fd9eae832d3cc190bbf0aaddee2f437103e134da486bbb50c34b8f973dab876b664308b8ab24e3470950d448fe622d7ac8ac0001d4347a22b1b1

Download Submit
memory/872-17-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/872-18-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/1204-0-0x0000000002180000-0x0000000002186000-memory.dmp

Filesize
24KB

Download
memory/1204-1-0x0000000002180000-0x0000000002186000-memory.dmp

Filesize
24KB

Download
memory/1204-2-0x00000000021B0000-0x00000000021B6000-memory.dmp

Filesize
24KB

Download