bc799212019f84d1777d9eacfae39a9829b1da456f22b842405c74562b1c8ce4

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-24_2fdb87d97d25c8c02323d531e861ade2_cryptolocker.exe
Size

37KB
MD5

2fdb87d97d25c8c02323d531e861ade2
SHA1

533fdf261a1d8ed7f600b0d6f326eb31e85d0c72
SHA256

bc799212019f84d1777d9eacfae39a9829b1da456f22b842405c74562b1c8ce4
SHA512

0aa051e22abd77bb1193c81173df8773baa3198b7e303e01d09a7691e57aa86172f5c0c5cd7ab38bb5d2eeb9331179e1280e783ce414b8ebed14083f2eb14293
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf0w3sp8u5cZnfXo:bgX4zYcgTEu6QOaryfjqDDw3sCu5mXo

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023226-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\International\Geo\Nation	2024-02-24_2fdb87d97d25c8c02323d531e861ade2_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4996	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 4996	3724	2024-02-24_2fdb87d97d25c8c02323d531e861ade2_cryptolocker.exe	87
PID 3724 wrote to memory of 4996	3724	2024-02-24_2fdb87d97d25c8c02323d531e861ade2_cryptolocker.exe	87
PID 3724 wrote to memory of 4996	3724	2024-02-24_2fdb87d97d25c8c02323d531e861ade2_cryptolocker.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-02-24_2fdb87d97d25c8c02323d531e861ade2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-24_2fdb87d97d25c8c02323d531e861ade2_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:4996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
38KB

MD5
ecfb0c79bf478344cd64d59d56448994

SHA1
a5f6374ec0ce6f0bbb0214b078b33271ccd7d569

SHA256
0d32b3742fd1731e4e8cb7a98df58938b5480c2a3c7d56952d1176cc2afd6984

SHA512
05ff64d1d3ee5771808c698d0effd88bf8aebee33f3817f22418b1704ac646546ae37c0a9657122411d06dc58144adabad14415471b777cf062fc1ab47582070

Download Submit
memory/3724-0-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/3724-1-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/3724-2-0x0000000002400000-0x0000000002406000-memory.dmp

Filesize
24KB

Download
memory/4996-17-0x0000000002280000-0x0000000002286000-memory.dmp

Filesize
24KB

Download
memory/4996-18-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download