60f1842b8321b2c845baa9cccba39da210e06ab7831048fb6ca6a753c1ca348f

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 10:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-09_369b833467d1b7640aab7c525c26adf2_cryptolocker.exe
Size

31KB
MD5

369b833467d1b7640aab7c525c26adf2
SHA1

7f3fe834a76a3be71b1a081d5e17b8f684ecb225
SHA256

60f1842b8321b2c845baa9cccba39da210e06ab7831048fb6ca6a753c1ca348f
SHA512

c416c683a76e0b1fbad636573343bef98c35299218e0c6d2f6522ec81b1e0be3c76dffb1ebba252dbd2e3851e77e21cff31b07001efec464c0110cf15d62fa11
SSDEEP

384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUGTG0n:bG74zYcgT/Ekd0ryfjvn

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/2016-0-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x0009000000023595-13.dat	CryptoLocker_rule2
behavioral2/memory/2016-17-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/1508-26-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	2024-05-09_369b833467d1b7640aab7c525c26adf2_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1508	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1508	2016	2024-05-09_369b833467d1b7640aab7c525c26adf2_cryptolocker.exe	88
PID 2016 wrote to memory of 1508	2016	2024-05-09_369b833467d1b7640aab7c525c26adf2_cryptolocker.exe	88
PID 2016 wrote to memory of 1508	2016	2024-05-09_369b833467d1b7640aab7c525c26adf2_cryptolocker.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-05-09_369b833467d1b7640aab7c525c26adf2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-09_369b833467d1b7640aab7c525c26adf2_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3904,i,13544508926340531097,6671217806016090640,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:8
1⤵
PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
31KB

MD5
50c2724eccbb234313cf7bf58c1acc27

SHA1
4c5895b94d617b49cb1ba670206e947dc7e6404e

SHA256
fbe5d51de509a6ab30c4f8569dea7b04a7bfc9378d41f43dde69f76798539b46

SHA512
666da196c9edebf77c7a6504fe528b3b732eb5027bda640bb12f18c23aacb796648da5a091561a82f2ab055fc627788d6102e176d460f5bb24527653afc6a437

Download Submit
memory/1508-19-0x0000000002120000-0x0000000002126000-memory.dmp

Filesize
24KB

Download
memory/1508-20-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/1508-26-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2016-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2016-1-0x0000000002250000-0x0000000002256000-memory.dmp

Filesize
24KB

Download
memory/2016-9-0x0000000002250000-0x0000000002256000-memory.dmp

Filesize
24KB

Download
memory/2016-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/2016-17-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download