f136d448d9294c8a41a653652f044a85ee4d6a188623445d0783367a0495d6c6

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-16_8a4646a8b0da449de75206b2c79141da_cryptolocker.exe
Size

31KB
MD5

8a4646a8b0da449de75206b2c79141da
SHA1

6f404c317c7f28858b5585885186b83a48c4a4ea
SHA256

f136d448d9294c8a41a653652f044a85ee4d6a188623445d0783367a0495d6c6
SHA512

d045794b3ff17046e77628743daa2362eedf34d1493cdb6d9eec6daa3c06c38f3211dd0d95e9c522623c35a9a84cc39aee4afd3233622f4a9e7d4dadaeccc496
SSDEEP

384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUGTGH:bG74zYcgT/Ekd0ryfjC

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/1788-0-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x00070000000233d2-13.dat	CryptoLocker_rule2
behavioral2/memory/1788-17-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/3804-26-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation	2024-04-16_8a4646a8b0da449de75206b2c79141da_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3804	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 3804	1788	2024-04-16_8a4646a8b0da449de75206b2c79141da_cryptolocker.exe	86
PID 1788 wrote to memory of 3804	1788	2024-04-16_8a4646a8b0da449de75206b2c79141da_cryptolocker.exe	86
PID 1788 wrote to memory of 3804	1788	2024-04-16_8a4646a8b0da449de75206b2c79141da_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-04-16_8a4646a8b0da449de75206b2c79141da_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-16_8a4646a8b0da449de75206b2c79141da_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:3804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
31KB

MD5
561a8a52869d62647d8888286be92f2d

SHA1
b1c303e1f29c924d018918e6003cebe64408688e

SHA256
921d74601ce2a00ca2d200648b6fe334442a4ea2e566000e7ac3699214a12859

SHA512
bea14a1f4ebf460c3726062e5865a2be1321f477e281b4daf6ba6dc506d2e4458acd78485ca539a4ae9752b291c6da62fd19fdea4f57d477511b406904e68cfc

Download Submit
memory/1788-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/1788-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/1788-2-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/1788-3-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/1788-17-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/3804-20-0x0000000002290000-0x0000000002296000-memory.dmp

Filesize
24KB

Download
memory/3804-19-0x0000000002260000-0x0000000002266000-memory.dmp

Filesize
24KB

Download
memory/3804-26-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download