96c535e5053797122ddc79e20d2d7a2321ed612fc1391af4f72191d2675bb357

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-18_307594aa4ba7c3a8e613bfc3b9dcbaa2_cryptolocker.exe
Size

389KB
MD5

307594aa4ba7c3a8e613bfc3b9dcbaa2
SHA1

d3f5035dc2b61eba9255c2450ca3e92949e927c7
SHA256

96c535e5053797122ddc79e20d2d7a2321ed612fc1391af4f72191d2675bb357
SHA512

50224cc153cf0d4fe6d31f4e96039003601f14080bf3040b6ca8a2d45c08bda407d771c4c8cc37a0086fcbb2d1911c5336d561798760d9ba498d3c5316bf1b07
SSDEEP

6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzX6:nnOflT/ZFIjBz3xjTxynGUOUhX6

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000001db0e-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	2024-04-18_307594aa4ba7c3a8e613bfc3b9dcbaa2_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4976	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 4976	4944	2024-04-18_307594aa4ba7c3a8e613bfc3b9dcbaa2_cryptolocker.exe	85
PID 4944 wrote to memory of 4976	4944	2024-04-18_307594aa4ba7c3a8e613bfc3b9dcbaa2_cryptolocker.exe	85
PID 4944 wrote to memory of 4976	4944	2024-04-18_307594aa4ba7c3a8e613bfc3b9dcbaa2_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-04-18_307594aa4ba7c3a8e613bfc3b9dcbaa2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-18_307594aa4ba7c3a8e613bfc3b9dcbaa2_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
389KB

MD5
aa08207d3b1cd8302ee0b0063166f9df

SHA1
7fa6433b714c7c627b106602eca7a8335e2d753f

SHA256
9168880b6b9fa44546ffadf0b9c84d4ad811ae4c553e746b87235cdd21b84679

SHA512
9e357df3ca3a525f86809e52f162821798e0c0476516ee6c9a7381e0306c68600502688c8b8cfcbf02876104b357fc9203ac91ac6f5f7dee4c768522c6b5d128

Download Submit
memory/4944-0-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/4944-1-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/4944-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/4976-17-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/4976-19-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download