1a66f4c7d00839197c6e110bf8ec7caf2423d69643558436c901a226b8d9d0e8

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 20:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_71b6f33283aab01e2b6b2034e7fab4a6_cryptolocker.exe
Size

47KB
MD5

71b6f33283aab01e2b6b2034e7fab4a6
SHA1

64b86d90e52dc3637d9934c44848119201321b0a
SHA256

1a66f4c7d00839197c6e110bf8ec7caf2423d69643558436c901a226b8d9d0e8
SHA512

156bfd58597ba226951f11179334dce6b3a939547f4b903908a221641e2154f74d3c661d1c874ead062077602b06b4882b56b32552083d105b23bb5ccfdec949
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37Yl6ddB:bgGYcA/53GAA6y37Q6ddB

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-02-12_71b6f33283aab01e2b6b2034e7fab4a6_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	2024-02-12_71b6f33283aab01e2b6b2034e7fab4a6_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

2220 hasfj.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2220	hasfj.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-02-12_71b6f33283aab01e2b6b2034e7fab4a6_cryptolocker.exe

description	pid	process	target process
PID 4244 wrote to memory of 2220	4244	2024-02-12_71b6f33283aab01e2b6b2034e7fab4a6_cryptolocker.exe	hasfj.exe
PID 4244 wrote to memory of 2220	4244	2024-02-12_71b6f33283aab01e2b6b2034e7fab4a6_cryptolocker.exe	hasfj.exe
PID 4244 wrote to memory of 2220	4244	2024-02-12_71b6f33283aab01e2b6b2034e7fab4a6_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\2024-02-12_71b6f33283aab01e2b6b2034e7fab4a6_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_71b6f33283aab01e2b6b2034e7fab4a6_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4244

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:2220

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
Filesize
47KB

MD5
e192d55b8fd2e401dcbbc7db9330feff

SHA1
2736f155a576026f87da6853b87b47476b1c31ac

SHA256
ed0c927d65578dd10b0cb3eef576c9bb48e64e36daf56295b100825075433074

SHA512
9640f54258c42ef99755a2bdfde4665205a3ca3a575bf27635daa2c5b3a4dc7f871f2e8a4724750c6208c5b3578dabb34b1d26faec856ef036d516b92a1fafca

Download Submit
memory/2220-17-0x00000000023C0000-0x00000000023C6000-memory.dmp

Filesize
24KB

Download
memory/2220-23-0x0000000002200000-0x0000000002206000-memory.dmp

Filesize
24KB

Download
memory/4244-0-0x0000000002260000-0x0000000002266000-memory.dmp

Filesize
24KB

Download
memory/4244-1-0x0000000002260000-0x0000000002266000-memory.dmp

Filesize
24KB

Download
memory/4244-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download