d15508465481592c90dd14361ba3407d785cefaaaa5ef6df8ae7786a6e952542

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 07:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-08_ec74f46338086f2697606812f158453c_cryptolocker.exe
Size

30KB
MD5

ec74f46338086f2697606812f158453c
SHA1

b2e21cbaba25062484d67778203e153edd914f95
SHA256

d15508465481592c90dd14361ba3407d785cefaaaa5ef6df8ae7786a6e952542
SHA512

fe9af6c2380501667ae7b8291eff0d994784f115dfe3afbb8a9053ba24d9c7dff351c53032c349f6fc8ff093487aca8956eb9855c211df0688e6ef2a5ec6a28c
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUr766SJ5STVnTi:bA74zYcgT/Ekd0ryfjQRSnWVTi

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002322e-11.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	2024-03-08_ec74f46338086f2697606812f158453c_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3096	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 3096	2364	2024-03-08_ec74f46338086f2697606812f158453c_cryptolocker.exe	91
PID 2364 wrote to memory of 3096	2364	2024-03-08_ec74f46338086f2697606812f158453c_cryptolocker.exe	91
PID 2364 wrote to memory of 3096	2364	2024-03-08_ec74f46338086f2697606812f158453c_cryptolocker.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-03-08_ec74f46338086f2697606812f158453c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-08_ec74f46338086f2697606812f158453c_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:3096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
30KB

MD5
1f598e20985220d53e2556ee4014a368

SHA1
cd840ad5c20c481f297f9175ef4d9e2cf9a67daa

SHA256
e71ade016a9f863484d2ce85f68a37034d3a4d5a7d82f278719715607af995eb

SHA512
14ef1ceec7e8d3ebfe343887e7f7faaa2dfceba04a65a155bd9093e2da078442900ade880dbad4c36ef09c1b05ec0eaced2921ae78cb922a15c82a414087c957

Download Submit
memory/2364-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/2364-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/2364-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/3096-17-0x0000000002230000-0x0000000002236000-memory.dmp

Filesize
24KB

Download
memory/3096-20-0x0000000002200000-0x0000000002206000-memory.dmp

Filesize
24KB

Download