809305acca7970cecbf196a21af8a044b902608111f06ea2907c452abcecbf09

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/02/2024, 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-11_dc297de81b3eefe6fa9c5acff17b6391_cryptolocker.exe
Size

41KB
MD5

dc297de81b3eefe6fa9c5acff17b6391
SHA1

19a15523f70c948c77c8f2bc0dbcfb6670c140ae
SHA256

809305acca7970cecbf196a21af8a044b902608111f06ea2907c452abcecbf09
SHA512

7230b4cd48a2df67b8f1d33d1332b146d49c24616770eadc047de88694ea2ca45eba3c24dc7352640c3961e50ff75161decdc158ef9ca64391da3e3d314f2814
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf0w3sp8u5co9+slGT:bgX4zYcgTEu6QOaryfjqDDw3sCu5b+s2

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023113-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	2024-02-11_dc297de81b3eefe6fa9c5acff17b6391_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1204	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 1204	4540	2024-02-11_dc297de81b3eefe6fa9c5acff17b6391_cryptolocker.exe	84
PID 4540 wrote to memory of 1204	4540	2024-02-11_dc297de81b3eefe6fa9c5acff17b6391_cryptolocker.exe	84
PID 4540 wrote to memory of 1204	4540	2024-02-11_dc297de81b3eefe6fa9c5acff17b6391_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-11_dc297de81b3eefe6fa9c5acff17b6391_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-11_dc297de81b3eefe6fa9c5acff17b6391_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
41KB

MD5
febb198b225e9275cd22d49fc0ea712f

SHA1
51886ae5b7e881e29dca489d47925c5bbd12eb0e

SHA256
271dc8170baca9b8375b86727251e001e0db9e10ae167d9becd91bc3264443c7

SHA512
09227e43fa470f45647e31dc47df7c6555698f6cdebdf5ff0dd4b053efb8c03124f2ed81932c19a0965b0f9d93cf4c28a329bbc185d6c01eddad96eaa10964da

Download Submit
memory/1204-17-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download
memory/1204-18-0x0000000002110000-0x0000000002116000-memory.dmp

Filesize
24KB

Download
memory/4540-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4540-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4540-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download