d299b69d6430625c744e7a440d6d803027d08e240e16ac883f83f18f2508e37c

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-15_ee3cc5eeb5d0f157047680a11e80489d_cryptolocker.exe
Size

33KB
MD5

ee3cc5eeb5d0f157047680a11e80489d
SHA1

fbd84327fff70503d6fa3d54a84886cb121bef90
SHA256

d299b69d6430625c744e7a440d6d803027d08e240e16ac883f83f18f2508e37c
SHA512

5da2f4ea71e6427bee4603a5121dd9e5f2fae57719ea5c0ad8f0d7c8e62fffb19e9523d005b4786403c00f15e79abc7ccb9b19180e9b3b23cadcbbcc5848d8bb
SSDEEP

384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUGTGXvJE:bG74zYcgT/Ekd0ryfjkG

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral2/memory/2436-0-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x0008000000022f51-13.dat	CryptoLocker_rule2
behavioral2/memory/1972-17-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2436-18-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/1972-27-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	2024-05-15_ee3cc5eeb5d0f157047680a11e80489d_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1972	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1972	2436	2024-05-15_ee3cc5eeb5d0f157047680a11e80489d_cryptolocker.exe	82
PID 2436 wrote to memory of 1972	2436	2024-05-15_ee3cc5eeb5d0f157047680a11e80489d_cryptolocker.exe	82
PID 2436 wrote to memory of 1972	2436	2024-05-15_ee3cc5eeb5d0f157047680a11e80489d_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-05-15_ee3cc5eeb5d0f157047680a11e80489d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-15_ee3cc5eeb5d0f157047680a11e80489d_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
33KB

MD5
325c4239207a08d637513685320d07e9

SHA1
355d5aa4334aa7b8d4bc91af19630944dba55acb

SHA256
49322cfc18f5f85fdd71338396addd732cafffade521560ca451f60cf7260791

SHA512
6a52c699bbb77929625747352ead7f636ca47487db274ddf7479d312afaa46fd6d10d29f03f60c9fd5bd83b758f02798f03567cf674116e9cfe27385eaaeb6f7

Download Submit
memory/1972-17-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/1972-26-0x0000000002120000-0x0000000002126000-memory.dmp

Filesize
24KB

Download
memory/1972-27-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2436-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2436-1-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download
memory/2436-2-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/2436-9-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download
memory/2436-18-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download