86d654c9f8144422729a55226e96c531472d55e0f8ba430a9940a3b094941744

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-23_37ab6e95c530f7fa086e2933135b5ae4_cryptolocker.exe
Size

385KB
MD5

37ab6e95c530f7fa086e2933135b5ae4
SHA1

4ae9ca5b55aed00c8e8d8b55c86da6b194d9b31a
SHA256

86d654c9f8144422729a55226e96c531472d55e0f8ba430a9940a3b094941744
SHA512

8f3040738152b43ba3849683e9d59da36d0725a3aa1115a253250bf5096c9b8e9a602f2a2265279559f3acaf4db0aefd51edb03cc6f228506bc173ed5d789ae6
SSDEEP

6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzXd:nnOflT/ZFIjBz3xjTxynGUOUhXd

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000001e96f-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\Control Panel\International\Geo\Nation	2024-02-23_37ab6e95c530f7fa086e2933135b5ae4_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2156	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 2156	4036	2024-02-23_37ab6e95c530f7fa086e2933135b5ae4_cryptolocker.exe	87
PID 4036 wrote to memory of 2156	4036	2024-02-23_37ab6e95c530f7fa086e2933135b5ae4_cryptolocker.exe	87
PID 4036 wrote to memory of 2156	4036	2024-02-23_37ab6e95c530f7fa086e2933135b5ae4_cryptolocker.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-02-23_37ab6e95c530f7fa086e2933135b5ae4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-23_37ab6e95c530f7fa086e2933135b5ae4_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
386KB

MD5
ff890e6faca29dea39d941add472d148

SHA1
d1f0d9cd4a1a78e769ca1904ca60293b4ff3ef2e

SHA256
194b7f0111d5abd2aab3f058948415f852e7c76305401ebe71487b3fbb6f2093

SHA512
6cec65c8495230dcf07da6bf7f20fae1a111e0f4d1b92994a68df3a40e2e1dc9819472f6e987ff57bd8878f5d94b34b5e7ec3af2b5b0fc3b8c8d6c960e8cb079

Download Submit
memory/2156-18-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/2156-17-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download
memory/4036-0-0x0000000002200000-0x0000000002206000-memory.dmp

Filesize
24KB

Download
memory/4036-1-0x0000000002200000-0x0000000002206000-memory.dmp

Filesize
24KB

Download
memory/4036-2-0x0000000002270000-0x0000000002276000-memory.dmp

Filesize
24KB

Download