3401f0ded35e0835a675741002e910bae2af5031b376f6814a906c3b57cd10a6

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 03:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-07_46188b4203291d9a2ae059b8b6dd3879_cryptolocker.exe
Size

42KB
MD5

46188b4203291d9a2ae059b8b6dd3879
SHA1

36aabbd19f470acd91dd827e05af75ffd308c76d
SHA256

3401f0ded35e0835a675741002e910bae2af5031b376f6814a906c3b57cd10a6
SHA512

410ab3935f93dcd442b3ac1ce2c1c2661ff648b9914846623d76268d3a8c6f3d9ee2644e4b2bf00d53ee419e97349e39d3431a697ee1e6840be9dc53c6d7a587
SSDEEP

384:bm74uGLLQRcsdeQ72ngEr4K7YmE8jb0nrlwfjDUw:bm74zYcgT/EkM0ryfjx

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral2/memory/5104-0-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x0012000000023a09-13.dat	CryptoLocker_rule2
behavioral2/memory/4432-17-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/5104-18-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/4432-26-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation	2024-05-07_46188b4203291d9a2ae059b8b6dd3879_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4432	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 4432	5104	2024-05-07_46188b4203291d9a2ae059b8b6dd3879_cryptolocker.exe	85
PID 5104 wrote to memory of 4432	5104	2024-05-07_46188b4203291d9a2ae059b8b6dd3879_cryptolocker.exe	85
PID 5104 wrote to memory of 4432	5104	2024-05-07_46188b4203291d9a2ae059b8b6dd3879_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-05-07_46188b4203291d9a2ae059b8b6dd3879_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-07_46188b4203291d9a2ae059b8b6dd3879_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:4432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
43KB

MD5
ed7fdce1a0f06ad157422f2feb946195

SHA1
8e1b53e07ae22a2aaa8283e9398ecfe3c23ce4d0

SHA256
99edfb94941e8d7858e44370e6e3743ee04e6749307c89feaf6262a9e130dc30

SHA512
92103074e5b7946a94e8b3bbdb5d6e0b6bd550910a26cac336e5c6cc7d482acd52767a73dd5fdcd6acb8a045b9e592e6b7bae5fa9e4bea674f3ba38dc3b5104e

Download Submit
memory/4432-17-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/4432-26-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/5104-0-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/5104-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/5104-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/5104-9-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/5104-18-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download