ef8bd51bc26d80fa525f40614489fd6b67de501ac32fcd6627606fec2e865296

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_3d5f37bdb370741f159f7e3fec3988be_cryptolocker.exe
Size

47KB
MD5

3d5f37bdb370741f159f7e3fec3988be
SHA1

8cf25a743fc4a26f71aaf6db10caeaa85692c678
SHA256

ef8bd51bc26d80fa525f40614489fd6b67de501ac32fcd6627606fec2e865296
SHA512

6a4c40bc0460e294c44a4af89ab2a3d636fc72a9a741bd31a8863fb51428968545181c36d61ba777663eacd2b38f1cd08a718e2bd11e795861af6766b4802af4
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37YbDu5z/hD5:bgGYcA/53GAA6y37nbd

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023210-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	2024-02-12_3d5f37bdb370741f159f7e3fec3988be_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2968	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2968	2192	2024-02-12_3d5f37bdb370741f159f7e3fec3988be_cryptolocker.exe	83
PID 2192 wrote to memory of 2968	2192	2024-02-12_3d5f37bdb370741f159f7e3fec3988be_cryptolocker.exe	83
PID 2192 wrote to memory of 2968	2192	2024-02-12_3d5f37bdb370741f159f7e3fec3988be_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-02-12_3d5f37bdb370741f159f7e3fec3988be_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_3d5f37bdb370741f159f7e3fec3988be_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
47KB

MD5
66ab7784d84b5c0d68f193383b818b1d

SHA1
ae42275b814345b5d28bcb939a27d53fc18b41fd

SHA256
6de888aadd54bcb907d8a8e634caaf54bf8df0f86bf6e72118ce9e334457b356

SHA512
8eb0d7fafc81aa55a371f703c14b1d05334b4a7b0a1a8ca0987bbeb956d78c74eb7d803c8c7360fc19900a591ac8f4996fdfe541f7872c40cd06e7f81b308f43

Download Submit
memory/2192-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/2192-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/2192-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/2968-18-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download
memory/2968-17-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download