863ad7600a28db232d3b95ed47ffb8e589efc972f3e3d0b1a18f680d9827288b

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-06_5a321066788401eb8ea1f3eb3a7de126_cryptolocker.exe
Size

44KB
MD5

5a321066788401eb8ea1f3eb3a7de126
SHA1

ef07d17926cfcd6b85c2ba3cbb44ab91ad0840fb
SHA256

863ad7600a28db232d3b95ed47ffb8e589efc972f3e3d0b1a18f680d9827288b
SHA512

af37a6c9b803457becf2c236b0455940acf96cbc05ed0952dbe61b652d3d945cb4aa4ad96bf465228cc7e7c27fbc5a0e0fb9890bab0ed6434b114dbf046a43fd
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDDw3sCu5b+syQNA5:bgGYcA/53GADw8Cl/n5

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023206-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	2024-04-06_5a321066788401eb8ea1f3eb3a7de126_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1060	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 1060	2268	2024-04-06_5a321066788401eb8ea1f3eb3a7de126_cryptolocker.exe	88
PID 2268 wrote to memory of 1060	2268	2024-04-06_5a321066788401eb8ea1f3eb3a7de126_cryptolocker.exe	88
PID 2268 wrote to memory of 1060	2268	2024-04-06_5a321066788401eb8ea1f3eb3a7de126_cryptolocker.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-04-06_5a321066788401eb8ea1f3eb3a7de126_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-06_5a321066788401eb8ea1f3eb3a7de126_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
44KB

MD5
a1c1b4312cf8569f22d63139e11552a1

SHA1
cb7206d11424404ec22b35afbc4d95714fd6bcff

SHA256
fe46a223223a6b851124a8bf66e91c12f8cdacc0499a0774c9eb0d1674b81056

SHA512
056e94eb934ea6f5fab52c8e481cfa2813b20cd17de3da8d12267cea3c5db011586616985685ea762da3f24a73ffdda6395380b06197b17976c5656fc7e8ad9a

Download Submit
memory/1060-17-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/1060-18-0x0000000002160000-0x0000000002166000-memory.dmp

Filesize
24KB

Download
memory/2268-0-0x0000000002250000-0x0000000002256000-memory.dmp

Filesize
24KB

Download
memory/2268-1-0x0000000002250000-0x0000000002256000-memory.dmp

Filesize
24KB

Download
memory/2268-2-0x0000000002280000-0x0000000002286000-memory.dmp

Filesize
24KB

Download