d3ca24dfffb21afbd6fe68ecb37071ddaaffa21f731917aaf99462454c6d6141

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 07:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-05-11_fad09af04db74d5e8b180c7ca45bfd9f_cryptolocker.exe
Size

36KB
MD5

fad09af04db74d5e8b180c7ca45bfd9f
SHA1

e778c3ddadbf9817593fdba3c680af31c77af748
SHA256

d3ca24dfffb21afbd6fe68ecb37071ddaaffa21f731917aaf99462454c6d6141
SHA512

b47b7a0b42b1156404e04086d57d171b69fdb0719c63ec5bb75fb8c51806465e973684a8ed7db53adb70f2a62d052ffc27cb99ef9bc619a1676f0523abce70f7
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf0w3sp8u5cZQx:bgX4zYcgTEu6QOaryfjqDDw3sCu5lx

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023296-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	2024-05-11_fad09af04db74d5e8b180c7ca45bfd9f_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2092	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 2092	1176	2024-05-11_fad09af04db74d5e8b180c7ca45bfd9f_cryptolocker.exe	85
PID 1176 wrote to memory of 2092	1176	2024-05-11_fad09af04db74d5e8b180c7ca45bfd9f_cryptolocker.exe	85
PID 1176 wrote to memory of 2092	1176	2024-05-11_fad09af04db74d5e8b180c7ca45bfd9f_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-05-11_fad09af04db74d5e8b180c7ca45bfd9f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-11_fad09af04db74d5e8b180c7ca45bfd9f_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
36KB

MD5
1a66c3d634c2b40fc514ba3b35bfe190

SHA1
83c605d42aba0a6117257d65b72ada6161cff7af

SHA256
26f0e6d2d332a387522d7ecf1a1abe7fd102f01e4ce0f8c18283de22a61df295

SHA512
e836def166317de7fa05f2cdf40262579c0469ba6ee27e27977642ba973cb6a8fcceca345a6be79c758b52e7aa5b43325f848ce5e9a63d0ef046328186e86669

Download Submit
memory/1176-0-0x0000000001F90000-0x0000000001F96000-memory.dmp

Filesize
24KB

Download
memory/1176-1-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/1176-8-0x0000000001F90000-0x0000000001F96000-memory.dmp

Filesize
24KB

Download
memory/2092-21-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download