Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2024, 11:41
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-15_5c46af4640394a086fab8153edc0e5a9_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-15_5c46af4640394a086fab8153edc0e5a9_cryptolocker.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-15_5c46af4640394a086fab8153edc0e5a9_cryptolocker.exe
-
Size
30KB
-
MD5
5c46af4640394a086fab8153edc0e5a9
-
SHA1
a7eb821436b03767b6201d19a2412871e6723c83
-
SHA256
0f3af209637c197bd42a75032936773f3ef6b67f699ded4779dde25131d6724a
-
SHA512
4c5e66b719b0558de23ff08aa10ff2ca25df739423f8ebbbb57600a4c81017078a33eafa8062960e23e9b126429d348e9ab890de1b5c0cf8305ca716d0f40fc3
-
SSDEEP
384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUGTGB:bG74zYcgT/Ekd0ryfjo
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
resource yara_rule behavioral2/memory/2792-0-0x0000000008000000-0x000000000800A000-memory.dmp CryptoLocker_rule2 behavioral2/files/0x000300000001e970-13.dat CryptoLocker_rule2 behavioral2/memory/2792-17-0x0000000008000000-0x000000000800A000-memory.dmp CryptoLocker_rule2 behavioral2/memory/5092-18-0x0000000008000000-0x000000000800A000-memory.dmp CryptoLocker_rule2 behavioral2/memory/5092-27-0x0000000008000000-0x000000000800A000-memory.dmp CryptoLocker_rule2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation 2024-04-15_5c46af4640394a086fab8153edc0e5a9_cryptolocker.exe -
Executes dropped EXE 1 IoCs
pid Process 5092 hasfj.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2792 wrote to memory of 5092 2792 2024-04-15_5c46af4640394a086fab8153edc0e5a9_cryptolocker.exe 89 PID 2792 wrote to memory of 5092 2792 2024-04-15_5c46af4640394a086fab8153edc0e5a9_cryptolocker.exe 89 PID 2792 wrote to memory of 5092 2792 2024-04-15_5c46af4640394a086fab8153edc0e5a9_cryptolocker.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-15_5c46af4640394a086fab8153edc0e5a9_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-15_5c46af4640394a086fab8153edc0e5a9_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
PID:5092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30KB
MD5bbb6ab80a524a164ff81555c441e97af
SHA1296f033ae0a944e110e0f4d9b06d96b2b9b8ac4f
SHA2560e761df982d2e65573f3d1cd9b6910c7d8ec8cb5c91d273b3ed79b67a14e4a6a
SHA512d682a0a42dd1926c62233c4e3ec1f25f2b06cc4f15449af30d3441cb7de46e72ba7aaeaf1f3126d21adcdde5e737f637efc3d69cbb59f0e7cfc337336e9e72b2