d0b9fb5f87716496f9d0e7ed67075e7d1874b44af780793f0b338d4701f479f1

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 00:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-26_84ef118440d9027097f756f46969b3d7_cryptolocker.exe
Size

52KB
MD5

84ef118440d9027097f756f46969b3d7
SHA1

ab5bb018eb456d304144daad4f34d287f18f7050
SHA256

d0b9fb5f87716496f9d0e7ed67075e7d1874b44af780793f0b338d4701f479f1
SHA512

5487832e90711528b0f93a179ef8acc1e4aed302ccbcf5894861124f44c09f58df5de606373120638ea195706d08f793d8f92b8b4026bbb3d88df39c0f82fded
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37Yl6dIKld5CS4Gju:bgGYcA/53GAA6y37Q6dI+d5QGi

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000001e97a-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	2024-04-26_84ef118440d9027097f756f46969b3d7_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1496	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 1496	3256	2024-04-26_84ef118440d9027097f756f46969b3d7_cryptolocker.exe	88
PID 3256 wrote to memory of 1496	3256	2024-04-26_84ef118440d9027097f756f46969b3d7_cryptolocker.exe	88
PID 3256 wrote to memory of 1496	3256	2024-04-26_84ef118440d9027097f756f46969b3d7_cryptolocker.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-04-26_84ef118440d9027097f756f46969b3d7_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-26_84ef118440d9027097f756f46969b3d7_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
52KB

MD5
cc90b131f49ef130df9ac0eeabf55e88

SHA1
db7ac80313adc69cad679093736e2bcb066ac66e

SHA256
e9d6e8c143bb025038f6d62a53a86330f3d610f2636db08910d34cda5c84e896

SHA512
adbad749c1bd64da3bdf558b5ec7e2c7c4c804287129379f676f899febcdb8b322ddb0f431d7c312b7f9395d26e788222565c60f89e850bb0cc00c5a3f998a73

Download Submit
memory/1496-17-0x0000000002590000-0x0000000002596000-memory.dmp

Filesize
24KB

Download
memory/3256-0-0x0000000002120000-0x0000000002126000-memory.dmp

Filesize
24KB

Download
memory/3256-2-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download
memory/3256-1-0x0000000002120000-0x0000000002126000-memory.dmp

Filesize
24KB

Download