a288ab016984d6638bd53effd1000a843b634c873c3095d45ec12b79a5c16b5f

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-15_fdeaa196bae5a951e20ecfff1dff17bd_cryptolocker.exe
Size

51KB
MD5

fdeaa196bae5a951e20ecfff1dff17bd
SHA1

fc81e87af664b6aefd6316e7a5f2aac662747ea4
SHA256

a288ab016984d6638bd53effd1000a843b634c873c3095d45ec12b79a5c16b5f
SHA512

dc8d809211e76c3faec73e6cd8b95c1a1a11d8141ad0557ea595b755a88a0268524bf9919cf2986f48fff20697ffb6bff946f1554b97f690b53ccb8076b98d56
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37Yl6dIKld5CS4Gju:bgGYcA/53GAA6y37Q6dI+d5QGi

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023404-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation	2024-04-15_fdeaa196bae5a951e20ecfff1dff17bd_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1168	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 1168	5068	2024-04-15_fdeaa196bae5a951e20ecfff1dff17bd_cryptolocker.exe	87
PID 5068 wrote to memory of 1168	5068	2024-04-15_fdeaa196bae5a951e20ecfff1dff17bd_cryptolocker.exe	87
PID 5068 wrote to memory of 1168	5068	2024-04-15_fdeaa196bae5a951e20ecfff1dff17bd_cryptolocker.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-04-15_fdeaa196bae5a951e20ecfff1dff17bd_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-15_fdeaa196bae5a951e20ecfff1dff17bd_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
51KB

MD5
79e9a09aade9394f97b5c77156301892

SHA1
4c4a4dc778e2c8aac05f12f506d613b38e5a7d8e

SHA256
e29d211fb41a9e7c2a97b46e9143e4564e5fed87f7d05cd01e3cba52ad6ff71f

SHA512
617330ada20b4da668793a7c6297e2414c235f9d718c2c6e89fb9947b321fd3a48cffad1563b55e93419741d6d96818bb34fd6de3af2dbfbe87315ba59607ed6

Download Submit
memory/1168-17-0x0000000002590000-0x0000000002596000-memory.dmp

Filesize
24KB

Download
memory/1168-19-0x0000000002560000-0x0000000002566000-memory.dmp

Filesize
24KB

Download
memory/5068-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/5068-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/5068-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download