1911915ebbe4694fc6fd9001460e072ff9f9187bf9d15b4f5d8ce888114b237d

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-03-2024 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-07_8c2b760aeb4e7fb258a045b60b4d8152_cryptolocker.exe
Size

38KB
MD5

8c2b760aeb4e7fb258a045b60b4d8152
SHA1

5c8607badfa9856ca9ea9ab2ef09b0f72384e90d
SHA256

1911915ebbe4694fc6fd9001460e072ff9f9187bf9d15b4f5d8ce888114b237d
SHA512

7e8005fd98f1a23295ee315b49222577e0b2154247fa34cbfb39015391c88ea7291384bfe65d380b242d5c727218f302761adadd55688bd2d0d8feaf90ffde03
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf0w3sp8u5cZnfXsTV2:bgX4zYcgTEu6QOaryfjqDDw3sCu5mXqI

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002322b-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	2024-03-07_8c2b760aeb4e7fb258a045b60b4d8152_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
220	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 220	2404	2024-03-07_8c2b760aeb4e7fb258a045b60b4d8152_cryptolocker.exe	91
PID 2404 wrote to memory of 220	2404	2024-03-07_8c2b760aeb4e7fb258a045b60b4d8152_cryptolocker.exe	91
PID 2404 wrote to memory of 220	2404	2024-03-07_8c2b760aeb4e7fb258a045b60b4d8152_cryptolocker.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-03-07_8c2b760aeb4e7fb258a045b60b4d8152_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-07_8c2b760aeb4e7fb258a045b60b4d8152_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
38KB

MD5
59185e301c20ce7d64683f2b654b9886

SHA1
fc975a489c3ce74cb45727110cbcd8951ad6b4ac

SHA256
2f6f5bc40d8c013add88bb97a7a796d65091cf39ce4ca3d502ab3c71dadebdbf

SHA512
48733dd322eafd064879c1418c51bde91b97a17e195d3bf7054f031fd7ce0cc86841169d78eeb59502f8df5a8d014bf72b5556cb468ddc9491ace106fa3b5015

Download Submit
memory/220-17-0x00000000020A0000-0x00000000020A6000-memory.dmp

Filesize
24KB

Download
memory/220-18-0x00000000020D0000-0x00000000020D6000-memory.dmp

Filesize
24KB

Download
memory/2404-0-0x0000000000740000-0x0000000000746000-memory.dmp

Filesize
24KB

Download
memory/2404-1-0x0000000000740000-0x0000000000746000-memory.dmp

Filesize
24KB

Download
memory/2404-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download