Analysis
-
max time kernel
151s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
08-04-2024 14:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-08_a5f9718baff1bcbaff5405c28ac8d686_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-08_a5f9718baff1bcbaff5405c28ac8d686_cryptolocker.exe
Resource
win10v2004-20240319-en
General
-
Target
2024-04-08_a5f9718baff1bcbaff5405c28ac8d686_cryptolocker.exe
-
Size
49KB
-
MD5
a5f9718baff1bcbaff5405c28ac8d686
-
SHA1
4d4a7867fc2eab44c99b987902716b9a0db7b34d
-
SHA256
19e48c26d9243f90ec6b72462211509a5cf94bd32d7d6e0ea528a1b154fb1724
-
SHA512
bcdc2eb00fb31e969924ea51e0928de6eb90111a9189205682ca90b9bdfd6faafa8317f85835897febaca7fd926e6953db4bbc97e25b9e49d2f728252bf1fc8d
-
SSDEEP
768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37YbDu5z/hvvkD98i:bgGYcA/53GAA6y37nby8i
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral2/files/0x000400000001db72-12.dat CryptoLocker_rule2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation 2024-04-08_a5f9718baff1bcbaff5405c28ac8d686_cryptolocker.exe -
Executes dropped EXE 1 IoCs
pid Process 1392 hasfj.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3044 wrote to memory of 1392 3044 2024-04-08_a5f9718baff1bcbaff5405c28ac8d686_cryptolocker.exe 93 PID 3044 wrote to memory of 1392 3044 2024-04-08_a5f9718baff1bcbaff5405c28ac8d686_cryptolocker.exe 93 PID 3044 wrote to memory of 1392 3044 2024-04-08_a5f9718baff1bcbaff5405c28ac8d686_cryptolocker.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-08_a5f9718baff1bcbaff5405c28ac8d686_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-08_a5f9718baff1bcbaff5405c28ac8d686_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
PID:1392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4456 --field-trial-handle=2252,i,3429015581403167983,2708022432612919502,262144 --variations-seed-version /prefetch:81⤵PID:1784
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD5b314b981e8bc2dd6fcee610419ba994a
SHA143e68266821f10b4038578effc1a09dded755851
SHA256cf3901ee9a7657cbb504011a6dfaf610dac3a860c8e56a792c9bed797861864a
SHA5122927f3f6654e302c5aa680dc6c1357e472f4d896e94d1aaff480ff23e8ef3d19153ea56892ad93fb0cedca2d9275e411582406ba11e9b9a4a210f752b800c3ce