481a1c0d13c0b6f1edbb6d293310ac88f07211d8f47be9ddcb040f5455507b48

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-26_ac7930d5fa6bc78b6923e6548ad4364b_cryptolocker.exe
Size

50KB
MD5

ac7930d5fa6bc78b6923e6548ad4364b
SHA1

16fc41a2b535a40b67f2fa295615da35157abe73
SHA256

481a1c0d13c0b6f1edbb6d293310ac88f07211d8f47be9ddcb040f5455507b48
SHA512

4e39c9e909bc0e7a3c928c13b1e4fd1b9ad4c761f0351071ba7aff768c0fb7a94c2c3252efc28805e25db6a06b9e5537fd30db54f607e10829fa8baab0d216d3
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37Yl6dIKld5CSO5D:bgGYcA/53GAA6y37Q6dI+d5ID

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00080000000231f2-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	2024-03-26_ac7930d5fa6bc78b6923e6548ad4364b_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1776	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 1776	4780	2024-03-26_ac7930d5fa6bc78b6923e6548ad4364b_cryptolocker.exe	90
PID 4780 wrote to memory of 1776	4780	2024-03-26_ac7930d5fa6bc78b6923e6548ad4364b_cryptolocker.exe	90
PID 4780 wrote to memory of 1776	4780	2024-03-26_ac7930d5fa6bc78b6923e6548ad4364b_cryptolocker.exe	90

C:\Users\Admin\AppData\Local\Temp\2024-03-26_ac7930d5fa6bc78b6923e6548ad4364b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-26_ac7930d5fa6bc78b6923e6548ad4364b_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
50KB

MD5
1ec1184ad3773c2697b4de33373adfbd

SHA1
e056c664d26aa01060e05202aecbd1eeab4883d5

SHA256
7428c28aac5ff67243ee8f1cbfb429e723db04e438bfdfa02666e2eb85284a9b

SHA512
6d6c438feab23aa9d4bb3b7dd6c77316fa877fad7067d9a1a8a38f89a79f34470395d76846ff838b030ab5194c37c39ce80d4473a96a2f99bf6b6ea6dfc92255

Download Submit
memory/1776-17-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/1776-18-0x00000000020A0000-0x00000000020A6000-memory.dmp

Filesize
24KB

Download
memory/4780-0-0x0000000002160000-0x0000000002166000-memory.dmp

Filesize
24KB

Download
memory/4780-1-0x0000000002160000-0x0000000002166000-memory.dmp

Filesize
24KB

Download
memory/4780-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download