b10017e4f419d1c4071e80f99591fe55a81051c594b270975249d68021829b78

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-15_0bd9e4c72021b15bbc072385477751e1_cryptolocker.exe
Size

39KB
MD5

0bd9e4c72021b15bbc072385477751e1
SHA1

351797b7eb4d4d939a9efa7aeb5ce6c398c0d929
SHA256

b10017e4f419d1c4071e80f99591fe55a81051c594b270975249d68021829b78
SHA512

9605bb90bbc03b7b2d632387b49fafb3b547de9a3fe71eb7049bfb1b3585ee602a73e9be4f87e0db9830e70b53dfba019516d030a6c89c7d1b4d7f5b9398618b
SSDEEP

768:bA74zYcgT/Ekd0ryfjPIunqpeNswmT3Hww:bA6YcA/X6G0W143Qw

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023270-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	2024-04-15_0bd9e4c72021b15bbc072385477751e1_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1736	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 1736	4004	2024-04-15_0bd9e4c72021b15bbc072385477751e1_cryptolocker.exe	85
PID 4004 wrote to memory of 1736	4004	2024-04-15_0bd9e4c72021b15bbc072385477751e1_cryptolocker.exe	85
PID 4004 wrote to memory of 1736	4004	2024-04-15_0bd9e4c72021b15bbc072385477751e1_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-04-15_0bd9e4c72021b15bbc072385477751e1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-15_0bd9e4c72021b15bbc072385477751e1_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
39KB

MD5
5aedf1f435b86840a6829c23ca29fae9

SHA1
436822a0e13477a28573a92406f82cefba0c3e58

SHA256
d8ce474180b8f2311a48ff41580c6d20d986cfd005b5aa78f37780aaa58645a9

SHA512
3733506d980e7061200f39663cdde41ae43f62989b6029d80b0a235dc48f1ed7af6777842e781915b737edcda34b9c1b87a0d18c81f59da3d576de8862fd738a

Download Submit
memory/1736-17-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/1736-20-0x00000000020A0000-0x00000000020A6000-memory.dmp

Filesize
24KB

Download
memory/4004-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4004-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4004-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download