69760d0761dd05987d56f54740e1d3748c3f4865b0668e665096b178f42c6b4b

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_b3e06f54bdf622de6999cf91c6bd6e11_cryptolocker.exe
Size

385KB
MD5

b3e06f54bdf622de6999cf91c6bd6e11
SHA1

727c877de245988c78a3226e262b8fb165475d06
SHA256

69760d0761dd05987d56f54740e1d3748c3f4865b0668e665096b178f42c6b4b
SHA512

d5981c50f155ade97d7f92a99af8f010c755eaad03f253801e519a5e62ceb0ac99c48281731c1247a5839edc342eb6eaeb77bf7505dfd7a15c10570f0cea4e01
SSDEEP

6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzXs:nnOflT/ZFIjBz3xjTxynGUOUhXs

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-02-12_b3e06f54bdf622de6999cf91c6bd6e11_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	2024-02-12_b3e06f54bdf622de6999cf91c6bd6e11_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

4116 hasfj.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4116	hasfj.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-02-12_b3e06f54bdf622de6999cf91c6bd6e11_cryptolocker.exe

description	pid	process	target process
PID 2656 wrote to memory of 4116	2656	2024-02-12_b3e06f54bdf622de6999cf91c6bd6e11_cryptolocker.exe	hasfj.exe
PID 2656 wrote to memory of 4116	2656	2024-02-12_b3e06f54bdf622de6999cf91c6bd6e11_cryptolocker.exe	hasfj.exe
PID 2656 wrote to memory of 4116	2656	2024-02-12_b3e06f54bdf622de6999cf91c6bd6e11_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\2024-02-12_b3e06f54bdf622de6999cf91c6bd6e11_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_b3e06f54bdf622de6999cf91c6bd6e11_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2656

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:4116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
385KB

MD5
f5f81cf4fb4e5a3910ffbf5da48ef2b4

SHA1
2c9581e5f591b6f288c23f916910a8e21cd4b0ad

SHA256
b6842b375ce9f22e0d37e99ddd31ee8786c4337add2c1ac417e2c74e9b2c9b86

SHA512
29f47c62f560dfcea895f5e8f8f9a963d62460573a90d6d0231d19291f2cdfe4df5119fa16d95314e0bd209823e11419d6107733d8c54ce44ca5e5f014f35738

Download Submit
memory/2656-0-0x00000000022C0000-0x00000000022C6000-memory.dmp

Filesize
24KB

Download
memory/2656-1-0x00000000022C0000-0x00000000022C6000-memory.dmp

Filesize
24KB

Download
memory/2656-2-0x00000000022F0000-0x00000000022F6000-memory.dmp

Filesize
24KB

Download
memory/4116-17-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/4116-23-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download