ea8658901798d11d8e996cc623d226fe36de644d4803613426adecdca3fa9c59

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-22_e691c661e26e01269fc74b12d4548ef4_cryptolocker.exe
Size

4.5MB
MD5

e691c661e26e01269fc74b12d4548ef4
SHA1

8acad3cabd96d7740603b3d7e54aed689f6cb809
SHA256

ea8658901798d11d8e996cc623d226fe36de644d4803613426adecdca3fa9c59
SHA512

68952b7d062a69ba3150868e9f7f41f5c2490ca4ad0ee202a72aa1db27942666bb105c1cfac38021ee15be7e7256d1495c640920be464820fa3c7f13e2a8d005
SSDEEP

98304:g/ZFIjBzldUfs/ZFIjBz7jSZD1tU7ymT9:g/ZFIjBzF/ZFIjBzPEUus9

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 2 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231f2-12.dat	CryptoLocker_rule2
behavioral2/files/0x00070000000231f2-14.dat	CryptoLocker_rule2

Detects executables built or packed with MPress PE compressor 2 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231f2-12.dat	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x00070000000231f2-14.dat	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\Control Panel\International\Geo\Nation	2024-02-22_e691c661e26e01269fc74b12d4548ef4_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
804	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 804	4916	2024-02-22_e691c661e26e01269fc74b12d4548ef4_cryptolocker.exe	88
PID 4916 wrote to memory of 804	4916	2024-02-22_e691c661e26e01269fc74b12d4548ef4_cryptolocker.exe	88
PID 4916 wrote to memory of 804	4916	2024-02-22_e691c661e26e01269fc74b12d4548ef4_cryptolocker.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-02-22_e691c661e26e01269fc74b12d4548ef4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-22_e691c661e26e01269fc74b12d4548ef4_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
396KB

MD5
634d7440a4fa1d55dfa4d8c9edbc499c

SHA1
916bc85b52c908b37939edd5436ccc4ff95ee475

SHA256
dbf17227f44caa7af2a6ab05e35c29b754d45e928376df35fa9b29a0304112c0

SHA512
0bda24af23b9a0c7e620917bc5e9ae4257696f84dfc2c66840ea877a6c2927b83eef4e1c87579c16b7d259635914c59876dcdfa7b945b174be04c1866d0ecb9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
4.5MB

MD5
0e023f36b9e6700407c159854025dfba

SHA1
af2016fa10ce30234e771f14f5a3568ff1e15e7c

SHA256
16836c687c775dd912700404cc3fb5959842ff2e61e3a62a58b52043a6693418

SHA512
147600689d37e0dfdee3a95cab20cf59fa061bf0823986b2e13efcadd492d0b73ddd058fba912b851c28a9de811f6c0bbf9ff22f556826618d0d8673f9acc008

Download Submit
memory/804-17-0x0000000002590000-0x0000000002596000-memory.dmp

Filesize
24KB

Download
memory/804-18-0x0000000002560000-0x0000000002566000-memory.dmp

Filesize
24KB

Download
memory/4916-0-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download
memory/4916-1-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download
memory/4916-2-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download