abeaffb3c6f14133aaf356c212095d5540dc74d587683d201a9c2f8bf0e2ed4f

Analysis

max time kernel
154s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 07:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-27_90590621942cef2b2d3a9c5a94a82402_cryptolocker.exe
Size

32KB
MD5

90590621942cef2b2d3a9c5a94a82402
SHA1

415ca5a6ddff624b8174d37792698f2f31134cad
SHA256

abeaffb3c6f14133aaf356c212095d5540dc74d587683d201a9c2f8bf0e2ed4f
SHA512

50f3d4ced2698da513c387932b30f2488b00218238005085cc843ad2c6d45dd12c4127c0037068509d83268d1134188459e965a39f99e00b1df4a46f236b8370
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUr766SJ/Tl+bltoGkUT:bA74zYcgT/Ekd0ryfjQRSlwltYUT

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000400000002271f-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-03-27_90590621942cef2b2d3a9c5a94a82402_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2648	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 2648	4840	2024-03-27_90590621942cef2b2d3a9c5a94a82402_cryptolocker.exe	98
PID 4840 wrote to memory of 2648	4840	2024-03-27_90590621942cef2b2d3a9c5a94a82402_cryptolocker.exe	98
PID 4840 wrote to memory of 2648	4840	2024-03-27_90590621942cef2b2d3a9c5a94a82402_cryptolocker.exe	98

C:\Users\Admin\AppData\Local\Temp\2024-03-27_90590621942cef2b2d3a9c5a94a82402_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-27_90590621942cef2b2d3a9c5a94a82402_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
32KB

MD5
6e86abed78da71be5cc7641b4653d054

SHA1
1c909953b61a7af13687e0cb3addfd850393a6a1

SHA256
cd08543eea983810720cfb3b00390643580284bab8046a1ab3d68a8497d408d6

SHA512
8d1cd676310ff97654025d076b865eaf92a409110978c4692696a71a56ffeeb79fa84a8f16a3e0fffe5b0833889042bb35b391df038f358f9f27404dcc213155

Download Submit
memory/2648-17-0x0000000002ED0000-0x0000000002ED6000-memory.dmp

Filesize
24KB

Download
memory/2648-19-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download
memory/4840-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4840-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4840-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download