c074202c2b43be6a01d82343d994dca412b94fbba709bb8cb183278df832d78e

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-09_a6b67298cbec8fe4c9c2596891eed0d5_cryptolocker.exe
Size

30KB
MD5

a6b67298cbec8fe4c9c2596891eed0d5
SHA1

490309770e32d4ed1db4bbd301a9b7e2037b38d0
SHA256

c074202c2b43be6a01d82343d994dca412b94fbba709bb8cb183278df832d78e
SHA512

341758d94df4c4afc20804891ff2349be34f36bde4d0594fa2075f3752ee6a8e6a241902f6d1ce812e4a84b77d666e1acdbecc0a03141f1278a97c785f937406
SSDEEP

384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUgL:bG74zYcgT/Ekd0ryfjv

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral2/memory/4284-0-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x000600000002301d-13.dat	CryptoLocker_rule2
behavioral2/memory/4284-18-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2860-17-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2860-27-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	2024-04-09_a6b67298cbec8fe4c9c2596891eed0d5_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2860	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 2860	4284	2024-04-09_a6b67298cbec8fe4c9c2596891eed0d5_cryptolocker.exe	87
PID 4284 wrote to memory of 2860	4284	2024-04-09_a6b67298cbec8fe4c9c2596891eed0d5_cryptolocker.exe	87
PID 4284 wrote to memory of 2860	4284	2024-04-09_a6b67298cbec8fe4c9c2596891eed0d5_cryptolocker.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-04-09_a6b67298cbec8fe4c9c2596891eed0d5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-09_a6b67298cbec8fe4c9c2596891eed0d5_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
30KB

MD5
81770da8128c3cbd150e328d384d440b

SHA1
b74f361bda1320bdff5d86740b9cf5603f7f6e4e

SHA256
1d4c973127524d4b30b2785b9116f936fd5211b8e56108851e337b7e1f7c68c9

SHA512
63a1a28f0ceeeea728199905820ee956dad00e9951c2f5014539d10a0114a1a2f5922407a5291d82cd73393016ab4516232b560bd4aa5510b15d34b4f3b08c67

Download Submit
memory/2860-17-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2860-26-0x0000000002200000-0x0000000002206000-memory.dmp

Filesize
24KB

Download
memory/2860-27-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/4284-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/4284-1-0x0000000002110000-0x0000000002116000-memory.dmp

Filesize
24KB

Download
memory/4284-2-0x0000000002110000-0x0000000002116000-memory.dmp

Filesize
24KB

Download
memory/4284-3-0x0000000003000000-0x0000000003006000-memory.dmp

Filesize
24KB

Download
memory/4284-18-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download