70f643c5d2ef3db8cec427e3c8da7b8b3d0996b440470999b3934bc0afb62d2d

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_00a75082c15a761178c44c4ef090a619_cryptolocker.exe
Size

37KB
MD5

00a75082c15a761178c44c4ef090a619
SHA1

0b19c174345912fa6f8353435d70c6a69cede34f
SHA256

70f643c5d2ef3db8cec427e3c8da7b8b3d0996b440470999b3934bc0afb62d2d
SHA512

c6bd79bd01903949219e62eec40e04487fe940f3abd53ae9918ee841688a72f16d8f95a1fff0e1fb21d90605b71010791d5fe9527e6b8842c68de81feddd4285
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf0w3sp8u5cZr/0j:bgX4zYcgTEu6QOaryfjqDDw3sCu5q/A

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-02-12_00a75082c15a761178c44c4ef090a619_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	2024-02-12_00a75082c15a761178c44c4ef090a619_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

1520 hasfj.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1520	hasfj.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-02-12_00a75082c15a761178c44c4ef090a619_cryptolocker.exe

description	pid	process	target process
PID 5052 wrote to memory of 1520	5052	2024-02-12_00a75082c15a761178c44c4ef090a619_cryptolocker.exe	hasfj.exe
PID 5052 wrote to memory of 1520	5052	2024-02-12_00a75082c15a761178c44c4ef090a619_cryptolocker.exe	hasfj.exe
PID 5052 wrote to memory of 1520	5052	2024-02-12_00a75082c15a761178c44c4ef090a619_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\2024-02-12_00a75082c15a761178c44c4ef090a619_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_00a75082c15a761178c44c4ef090a619_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5052

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
37KB

MD5
bfe97f78de43713e6f94eb44cc309e98

SHA1
17afa46811c1ec867863ccf6e23d332b4ede74a9

SHA256
d3d01d887e79808365f00e11f03a5a3f4ae51555820d1c3678554e05231859cd

SHA512
3b7ff2197fd55d4b0bf3d12ce879bcb8b2a3500f6a136dcbc422553050404637527171ad867b9e03923dc5bd65663f6d5bc9495ac37b18d3b6bd5df77637c2ac

Download Submit
memory/1520-18-0x0000000002110000-0x0000000002116000-memory.dmp

Filesize
24KB

Download
memory/1520-17-0x0000000002ED0000-0x0000000002ED6000-memory.dmp

Filesize
24KB

Download
memory/5052-0-0x00000000022D0000-0x00000000022D6000-memory.dmp

Filesize
24KB

Download
memory/5052-1-0x00000000022D0000-0x00000000022D6000-memory.dmp

Filesize
24KB

Download
memory/5052-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download