6473a36e5f75cba2d0253204f6e60761c2aac12e411610ac10a4edfa35dbf628

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23-04-2024 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-23_7c1a224f7224dff8293a02ba9ab55d06_cryptolocker.exe
Size

43KB
MD5

7c1a224f7224dff8293a02ba9ab55d06
SHA1

ddb36dc127a89033fbd389480805bd316adc9244
SHA256

6473a36e5f75cba2d0253204f6e60761c2aac12e411610ac10a4edfa35dbf628
SHA512

f13767da9d4db603661d72a8622b823b80323b8c04949215a04810c978703a3037e9029e4a76fb74f767fc826981241368cd896bc9838213d6b8c1bf8b9a986a
SSDEEP

384:bm74uGLLQRcsdeQ72ngEr4K7YmE8jo0nrlwfjDU13SI:bm74zYcgT/Ekn0ryfjMh

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/4668-0-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x0009000000023401-13.dat	CryptoLocker_rule2
behavioral2/memory/4668-17-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/1204-26-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	2024-04-23_7c1a224f7224dff8293a02ba9ab55d06_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1204	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 1204	4668	2024-04-23_7c1a224f7224dff8293a02ba9ab55d06_cryptolocker.exe	87
PID 4668 wrote to memory of 1204	4668	2024-04-23_7c1a224f7224dff8293a02ba9ab55d06_cryptolocker.exe	87
PID 4668 wrote to memory of 1204	4668	2024-04-23_7c1a224f7224dff8293a02ba9ab55d06_cryptolocker.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-04-23_7c1a224f7224dff8293a02ba9ab55d06_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-23_7c1a224f7224dff8293a02ba9ab55d06_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
43KB

MD5
767132eb7a0910a62b4086802d6bd003

SHA1
5d599b0ba39ef74309d0e6ca43a5f3b6a14ce9e9

SHA256
c24c28b897db20c39ebbf737c85b19a9a6603605a90d40388912dae3b033a98d

SHA512
c5dbb9f24546b7c5e096119aea420a73a01f3aa33a1b4066a0f41db3b59002ff716f5274d375d4f70220a3a31d7cc582c31caaa240f20e4c8d674392cea53396

Download Submit
memory/1204-19-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/1204-25-0x0000000000770000-0x0000000000776000-memory.dmp

Filesize
24KB

Download
memory/1204-26-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/4668-0-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/4668-1-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/4668-2-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/4668-3-0x0000000002270000-0x0000000002276000-memory.dmp

Filesize
24KB

Download
memory/4668-17-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download