7a583e0a4917f6121cceac8b9e740845490bc7f6293deea58080a09761c3fa6f

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-12_f74ff627203cd7d89da89e5bb3ec3e13_cryptolocker.exe
Size

38KB
MD5

f74ff627203cd7d89da89e5bb3ec3e13
SHA1

215d319f53d5df0af4a86e62cc0a0472c04feb4e
SHA256

7a583e0a4917f6121cceac8b9e740845490bc7f6293deea58080a09761c3fa6f
SHA512

da70b372698f294bd0a124913e88d214875f908afea506ca9063b950cd37e66f5b2ada2f70f416ac5aaff9275b3a01c070d55dc6177ecaa52ef516ca6c9c60a8
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf0w3sp8u5cZnfVu/xnu:bgX4zYcgTEu6QOaryfjqDDw3sCu5mU8

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000001e59e-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	2024-03-12_f74ff627203cd7d89da89e5bb3ec3e13_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2004	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 2004	3724	2024-03-12_f74ff627203cd7d89da89e5bb3ec3e13_cryptolocker.exe	88
PID 3724 wrote to memory of 2004	3724	2024-03-12_f74ff627203cd7d89da89e5bb3ec3e13_cryptolocker.exe	88
PID 3724 wrote to memory of 2004	3724	2024-03-12_f74ff627203cd7d89da89e5bb3ec3e13_cryptolocker.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-03-12_f74ff627203cd7d89da89e5bb3ec3e13_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-12_f74ff627203cd7d89da89e5bb3ec3e13_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
38KB

MD5
c0f682c41e5b54d30e178e1eb6ce0f06

SHA1
e3cf01b75d3f656d52c589c6503ef5cdecaea6ce

SHA256
28d2169f0665ecf913f6dda8693ea7ee32b1037ebd5d11ad0896e641a14a754a

SHA512
65dba17fa39de8b6b8d5ca271e09e7018b32298e80a5a8b39159a3a7f114a727e01f5243f74a12b7e1dc45761249e624a0105f623089b4e64d03292a6a979309

Download Submit
memory/2004-18-0x0000000000780000-0x0000000000786000-memory.dmp

Filesize
24KB

Download
memory/2004-17-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download
memory/3724-0-0x00000000021E0000-0x00000000021E6000-memory.dmp

Filesize
24KB

Download
memory/3724-1-0x00000000021E0000-0x00000000021E6000-memory.dmp

Filesize
24KB

Download
memory/3724-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download