bcd260539ccf2259c3cb4479057424b4cdacbbc0a48dcfd430d10ddc0bd08d20

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-02-2024 09:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-29_d34178f08a6302be85e767fca230b75f_cryptolocker.exe
Size

49KB
MD5

d34178f08a6302be85e767fca230b75f
SHA1

af035cb3312aa16b47c4a535d2e32be42f61f9b9
SHA256

bcd260539ccf2259c3cb4479057424b4cdacbbc0a48dcfd430d10ddc0bd08d20
SHA512

6aff427ba1dd3c185ce4e2a3c98fdc51e0bf7ef3d833f592b73024fac575cfa954c7df748025738104245fb3eea3e476c120a0093e3ae9745c98280897006df2
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37Yl6dIKld5CSm:bgGYcA/53GAA6y37Q6dI+d5+

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023210-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	2024-02-29_d34178f08a6302be85e767fca230b75f_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2236	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 2236	3712	2024-02-29_d34178f08a6302be85e767fca230b75f_cryptolocker.exe	89
PID 3712 wrote to memory of 2236	3712	2024-02-29_d34178f08a6302be85e767fca230b75f_cryptolocker.exe	89
PID 3712 wrote to memory of 2236	3712	2024-02-29_d34178f08a6302be85e767fca230b75f_cryptolocker.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-02-29_d34178f08a6302be85e767fca230b75f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-29_d34178f08a6302be85e767fca230b75f_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
49KB

MD5
6edbf8b5913464a77d899131ab6cf3c8

SHA1
246c9ff89a44228e22b5998c567d15033088cbcc

SHA256
8eea1c2e1f881ba36dc637428833db19a165cc33adce0960269cfbeb16084295

SHA512
be4ddd84d981c792b2349586005b167c47e47b887f6959751fd5fb21719f95381dc83b076f25aa4943640c2e65ccf90f6d5f269dcadaa82e8092af7518c1581f

Download Submit
memory/2236-17-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/2236-19-0x0000000002120000-0x0000000002126000-memory.dmp

Filesize
24KB

Download
memory/3712-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/3712-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/3712-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download