68306f92dfadd468f708821b057f7c0e047c912b6cfa3b16d5ca4a41dbc3cdad

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_7c447cd0a46c75b623f1963731fa209e_cryptolocker.exe
Size

33KB
MD5

7c447cd0a46c75b623f1963731fa209e
SHA1

3b21c8cd424b1aa1d2ff4bb6b572f32c34ed9202
SHA256

68306f92dfadd468f708821b057f7c0e047c912b6cfa3b16d5ca4a41dbc3cdad
SHA512

f0ea830eb3e562df6d23644dafa52b71596d03d582ff66c8a240f32dd3ea933d26eeee9b628ae4dbe240696697a9d7746c6f6e528bfebddf8b73ededa9c22aac
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUgIunexRlSrxVfdsHYUpZ:bA74zYcgT/Ekd0ryfjPIunYw16lZ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-02-12_7c447cd0a46c75b623f1963731fa209e_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	2024-02-12_7c447cd0a46c75b623f1963731fa209e_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

3456 hasfj.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3456	hasfj.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-02-12_7c447cd0a46c75b623f1963731fa209e_cryptolocker.exe

description	pid	process	target process
PID 1032 wrote to memory of 3456	1032	2024-02-12_7c447cd0a46c75b623f1963731fa209e_cryptolocker.exe	hasfj.exe
PID 1032 wrote to memory of 3456	1032	2024-02-12_7c447cd0a46c75b623f1963731fa209e_cryptolocker.exe	hasfj.exe
PID 1032 wrote to memory of 3456	1032	2024-02-12_7c447cd0a46c75b623f1963731fa209e_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\2024-02-12_7c447cd0a46c75b623f1963731fa209e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_7c447cd0a46c75b623f1963731fa209e_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1032

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:3456

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
Filesize
34KB

MD5
a80f093650cc894df65f2802ac8ec3e1

SHA1
7956bb9bbaa8dc4945e923d5900c6c7617e7f831

SHA256
0a7da515283fa4915af665ad396f25c4328ac35449347b55daf77663bce0e0c1

SHA512
dcb6971bf48d9327e289e06d7fadbac1ddf8fc928297e99df78709ffcf6b44955e911b1c76e2cff0b37a10cbe5c18b2d376c88b58a2f02befdc665738c0237b7

Download Submit
memory/1032-0-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/1032-1-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/1032-2-0x0000000002400000-0x0000000002406000-memory.dmp

Filesize
24KB

Download
memory/3456-19-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/3456-17-0x00000000021C0000-0x00000000021C6000-memory.dmp

Filesize
24KB

Download