Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/02/2024, 19:52

General

  • Target

    2024-02-11_a6bd9dbe291ec9b73f9bd5ce9da384e2_cryptolocker.exe

  • Size

    48KB

  • MD5

    a6bd9dbe291ec9b73f9bd5ce9da384e2

  • SHA1

    4871fd7a0dbde10037467ab721ee19a61be33dd1

  • SHA256

    a9b0fa55ad4dcf1528d63aea12accf96c483f410b1406564785f60e8c548d1e3

  • SHA512

    e5072d40d4b11181752abef33be40afdfc13f8ccd5eeacd44bbd899565f59a1e46b9b7e3a6ee930e76332faeb74c985bf98af75958922b66d62ea721e00d7c37

  • SSDEEP

    768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37Yl6dIKld5CAZ:bgGYcA/53GAA6y37Q6dI+d5j

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-11_a6bd9dbe291ec9b73f9bd5ce9da384e2_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-11_a6bd9dbe291ec9b73f9bd5ce9da384e2_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1272
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:1360

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    48KB

    MD5

    a43742579ce5650ee15fb0d9f1901ad2

    SHA1

    8e87c1b9e5d06847239a1277fbd9e507ed52791d

    SHA256

    cb14632d4736a3270214494b47b164da5457d6e9da17abaad5db42bb0c640cca

    SHA512

    bbbf81fdbbed9a44aa077902cec0d247fee22f28911fb58a2cd1a652a56e4a24b157434417bc995eb37a193639206a155881aa5cefeadddebceee5c05dddae06

  • memory/1272-0-0x0000000002200000-0x0000000002206000-memory.dmp

    Filesize

    24KB

  • memory/1272-1-0x0000000002200000-0x0000000002206000-memory.dmp

    Filesize

    24KB

  • memory/1272-2-0x0000000003010000-0x0000000003016000-memory.dmp

    Filesize

    24KB

  • memory/1360-17-0x0000000002180000-0x0000000002186000-memory.dmp

    Filesize

    24KB