a138f97df51916083b0537cbf5f38edcb71d2a7d5bc78c861fab671779240347

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 08:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-23_f628f609479bd993f732fd8b2df2922f_cryptolocker.exe
Size

34KB
MD5

f628f609479bd993f732fd8b2df2922f
SHA1

4b0e452de6224f6267e2e503bb9fcde0d9c095bd
SHA256

a138f97df51916083b0537cbf5f38edcb71d2a7d5bc78c861fab671779240347
SHA512

b5349dccd07e60eb7bc017fab130b2c89dc7df9a9f5941e2494a47a4c95e83fc29d2c96466651fce96576a1aaf9b81b32c6fde9becb54cb7a662c033c23e7361
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUgIunexRlSrxVM:bA74zYcgT/Ekd0ryfjPIunYwK

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000002321b-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2828415587-3732861812-1919322417-1000\Control Panel\International\Geo\Nation	2024-02-23_f628f609479bd993f732fd8b2df2922f_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2492	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 2492	1076	2024-02-23_f628f609479bd993f732fd8b2df2922f_cryptolocker.exe	88
PID 1076 wrote to memory of 2492	1076	2024-02-23_f628f609479bd993f732fd8b2df2922f_cryptolocker.exe	88
PID 1076 wrote to memory of 2492	1076	2024-02-23_f628f609479bd993f732fd8b2df2922f_cryptolocker.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-02-23_f628f609479bd993f732fd8b2df2922f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-23_f628f609479bd993f732fd8b2df2922f_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
34KB

MD5
5bd6af2e12bf03942af95691ceaa4016

SHA1
611f2e2dd15120afcba2aba36d9f1a2fee43d471

SHA256
20623347e7ea57f241445fdfb31ce5d8223140d7c783077237d72ae677b2f572

SHA512
3c3db06caa18d9324c42d325c5231ec17488b12d1a6a84192755d9f3310ccb98d26702abecd229f55876fd05d9d5f38acbdb677e8b1f357d006a36cb8c0732c0

Download Submit
memory/1076-0-0x0000000002260000-0x0000000002266000-memory.dmp

Filesize
24KB

Download
memory/1076-1-0x0000000002260000-0x0000000002266000-memory.dmp

Filesize
24KB

Download
memory/1076-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/2492-17-0x0000000002ED0000-0x0000000002ED6000-memory.dmp

Filesize
24KB

Download
memory/2492-19-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download