a24911daf1662ecbc3750243fb75486d5a071fad67df23370dfe5d402ae4d2fe

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 04:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-13_5815fba7b5ab13401956fce3f99a76be_cryptolocker.exe
Size

387KB
MD5

5815fba7b5ab13401956fce3f99a76be
SHA1

da3922057b8a12bb01e9314d4071af19308cefff
SHA256

a24911daf1662ecbc3750243fb75486d5a071fad67df23370dfe5d402ae4d2fe
SHA512

e325ab887435228db083face659e27158b4ead71b2a34561bc151865bcfd0fa5d300bf28b0904bb0c9eda04a2ac4393282868f4e64c6a893f7151b5bfff191e6
SSDEEP

6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzXp:nnOflT/ZFIjBz3xjTxynGUOUhXp

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000400000001e5eb-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	2024-03-13_5815fba7b5ab13401956fce3f99a76be_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1608	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 1608	3308	2024-03-13_5815fba7b5ab13401956fce3f99a76be_cryptolocker.exe	88
PID 3308 wrote to memory of 1608	3308	2024-03-13_5815fba7b5ab13401956fce3f99a76be_cryptolocker.exe	88
PID 3308 wrote to memory of 1608	3308	2024-03-13_5815fba7b5ab13401956fce3f99a76be_cryptolocker.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-03-13_5815fba7b5ab13401956fce3f99a76be_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-13_5815fba7b5ab13401956fce3f99a76be_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
387KB

MD5
7d444a3f21a0d3d47c4e693d52295d1b

SHA1
3df219a7f34ad939599b80e45f13aaaf6400b14a

SHA256
44dc367e70ef1ee9179a6ea4e9a7ecd5fcd9c9890dd4a9da280ff15ee75c4978

SHA512
5d55ec872ee1d111892ef7d589f0de5932f3c3385e2a01244058d1f78011777ef83d48718291f461744773b46c37fb793ca4188b55d705cf72de5b98ca149c33

Download Submit
memory/1608-17-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/1608-19-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download
memory/3308-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/3308-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/3308-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download