da8e90b90043b6dc7e624a4c11e213d4d0707457a73061a3422a95856e408122

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-06_ce7ecc2207e7ea614f1f158271b1c396_cryptolocker.exe
Size

40KB
MD5

ce7ecc2207e7ea614f1f158271b1c396
SHA1

09d1ea92b8f85dd81b1c29d22e1a881da3d559bc
SHA256

da8e90b90043b6dc7e624a4c11e213d4d0707457a73061a3422a95856e408122
SHA512

97001bab196f9e7951199dc5b7ba9548f0d2b4d9f115ca6eb061dd9182c1e021acadb71cd6770c249bc215d363822d5c6aef41105a7a3acb7cb3cefb5804457e
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDDw3sCu5mXfR1:bgGYcA/53GADw8C3vR1

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000f000000023124-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	2024-04-06_ce7ecc2207e7ea614f1f158271b1c396_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3024	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 3024	2280	2024-04-06_ce7ecc2207e7ea614f1f158271b1c396_cryptolocker.exe	85
PID 2280 wrote to memory of 3024	2280	2024-04-06_ce7ecc2207e7ea614f1f158271b1c396_cryptolocker.exe	85
PID 2280 wrote to memory of 3024	2280	2024-04-06_ce7ecc2207e7ea614f1f158271b1c396_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-04-06_ce7ecc2207e7ea614f1f158271b1c396_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-06_ce7ecc2207e7ea614f1f158271b1c396_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
40KB

MD5
a9d1220d9243b3562b6210dee5d3b523

SHA1
513d5626b59cc4c0fdf98d38368fe3beb3a45f3d

SHA256
7689d52d17750688d5aeffda039f4cc38183782ebde9030278407eda775c07cc

SHA512
b05e2dc24157ee4205a91c7f77ea8bbbc7e35644a34fd9e18f4c21893130ab0de4013a43f662637662971ed1bf6e15f281a109ae46f62ff0e019a0e8a8d21245

Download Submit
memory/2280-0-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/2280-1-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/2280-2-0x00000000023C0000-0x00000000023C6000-memory.dmp

Filesize
24KB

Download
memory/3024-17-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/3024-18-0x0000000002200000-0x0000000002206000-memory.dmp

Filesize
24KB

Download