8ed74937eef7bdf98f725b64ac9811427d67c4387d6f5604e0367303c49aa642

Analysis

max time kernel
157s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 05:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-12_834d5ea0cde765981364d059742e0359_cryptolocker.exe
Size

33KB
MD5

834d5ea0cde765981364d059742e0359
SHA1

07d5034b0d6bd1455b6b569f4f724c3e1f5ab2ad
SHA256

8ed74937eef7bdf98f725b64ac9811427d67c4387d6f5604e0367303c49aa642
SHA512

d619d50594d48ee4a8fb7953928dc5bc0658eb5c93855b63d12251bebe90a350753ca6abbd5cf38bcac33af1fa5c171274907ce4f4b7848c524dc565763e071b
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUgIunIVpeNs23mAA6lJ:bA74zYcgT/Ekd0ryfjPIunqpeNswmq

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023215-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	2024-03-12_834d5ea0cde765981364d059742e0359_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3488	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 3488	1168	2024-03-12_834d5ea0cde765981364d059742e0359_cryptolocker.exe	90
PID 1168 wrote to memory of 3488	1168	2024-03-12_834d5ea0cde765981364d059742e0359_cryptolocker.exe	90
PID 1168 wrote to memory of 3488	1168	2024-03-12_834d5ea0cde765981364d059742e0359_cryptolocker.exe	90

C:\Users\Admin\AppData\Local\Temp\2024-03-12_834d5ea0cde765981364d059742e0359_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-12_834d5ea0cde765981364d059742e0359_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:3488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
33KB

MD5
cab2e40adcdaf574b657dca4d8681384

SHA1
304b21b31a5c747bef6951d3b7d33ea635499ee4

SHA256
056ad93b3f07a4687e6849e31b246a3ba9b8b2a178de5192d33354c64eae86c4

SHA512
fe95ed502d98771969333a73f41bd6de4c9b6ef564e865a65e3b468ef288370d0d6b8c20aa30da71073cf3a0f5a90fff16cb71cd082c131ebce048e116c4cc72

Download Submit
memory/1168-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/1168-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/1168-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/3488-17-0x0000000002040000-0x0000000002046000-memory.dmp

Filesize
24KB

Download
memory/3488-19-0x0000000002010000-0x0000000002016000-memory.dmp

Filesize
24KB

Download