2999e7f97d3434311d2f68f47af2afe0d811230b67b981d3530bd8fa7862d00e

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-02-2024 03:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-19_b6199d4e4da2ab6cacc4157fa04740c6_cryptolocker.exe
Size

47KB
MD5

b6199d4e4da2ab6cacc4157fa04740c6
SHA1

6e7a3557db270898e2aa1b8026668bf4b6bd3479
SHA256

2999e7f97d3434311d2f68f47af2afe0d811230b67b981d3530bd8fa7862d00e
SHA512

4590f023233e3f05f26867907d9fce875572b6417ea28e1891ee9fd5c76730418d2fd870225f5afe043214c26e1217f2cc7a932b206eaf2f1519dbd65678e1e1
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37YbDu5z/hQcEp70:bgGYcA/53GAA6y37nbQq

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023200-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	2024-02-19_b6199d4e4da2ab6cacc4157fa04740c6_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1380	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 1380	3492	2024-02-19_b6199d4e4da2ab6cacc4157fa04740c6_cryptolocker.exe	84
PID 3492 wrote to memory of 1380	3492	2024-02-19_b6199d4e4da2ab6cacc4157fa04740c6_cryptolocker.exe	84
PID 3492 wrote to memory of 1380	3492	2024-02-19_b6199d4e4da2ab6cacc4157fa04740c6_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-19_b6199d4e4da2ab6cacc4157fa04740c6_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-19_b6199d4e4da2ab6cacc4157fa04740c6_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
48KB

MD5
ad18fb0fa7a9be6572f5b2f2fd2b8a3b

SHA1
f6f8b5f3125b2571fca8fcdec2811b43a065909e

SHA256
5975577731a1ae8939c110e697a03c14c2540a7c9a5829249cd5f40c29aeb50d

SHA512
3168c0769d0e2965ee66636f759b161e3da5fd58f03a8de5d0e2ecc8c0bb150441d78fc16b27853b0163b158b29b9092088195e590c75f84c882bcd0c8014dc8

Download Submit
memory/1380-18-0x0000000002010000-0x0000000002016000-memory.dmp

Filesize
24KB

Download
memory/1380-17-0x00000000020D0000-0x00000000020D6000-memory.dmp

Filesize
24KB

Download
memory/3492-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/3492-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/3492-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download