aae2a2618318c9a84312833ba0deb1108a5b13ec0b3c1dc95c8e42d7b32e881f

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-21_4700e2ab30986b42170c21e6324783cc_cryptolocker.exe
Size

40KB
MD5

4700e2ab30986b42170c21e6324783cc
SHA1

d06d8e17625d0885ac86a5c6a6ae6f55406bbc1b
SHA256

aae2a2618318c9a84312833ba0deb1108a5b13ec0b3c1dc95c8e42d7b32e881f
SHA512

a99daf463a53dd25c506c49a613e6ece7c224f4f7ef835b0e473dddda96d8993cec9975a23b7f4f092926098ebb107522a95471ce906688ce082f8b77ac780b5
SSDEEP

768:bA74zYcgT/Ekd0ryfjPIunqpeNswmT3HwT9W:bA6YcA/X6G0W143QTY

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-21_4700e2ab30986b42170c21e6324783cc_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	2024-05-21_4700e2ab30986b42170c21e6324783cc_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

2436 hasfj.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2436	hasfj.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-21_4700e2ab30986b42170c21e6324783cc_cryptolocker.exe

description	pid	process	target process
PID 1628 wrote to memory of 2436	1628	2024-05-21_4700e2ab30986b42170c21e6324783cc_cryptolocker.exe	hasfj.exe
PID 1628 wrote to memory of 2436	1628	2024-05-21_4700e2ab30986b42170c21e6324783cc_cryptolocker.exe	hasfj.exe
PID 1628 wrote to memory of 2436	1628	2024-05-21_4700e2ab30986b42170c21e6324783cc_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_4700e2ab30986b42170c21e6324783cc_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_4700e2ab30986b42170c21e6324783cc_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1628

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:2436

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
Filesize
40KB

MD5
a74708971cefcedc69c94f49db497a08

SHA1
8712fa1835681b97b8f4da2d0e620075e40fe307

SHA256
ed1697a909940966d5c3c663764b7d0f2b3c9d26a814c5852544a9f72725db75

SHA512
4f431b17099b4d55ab58d6849f47ae0d721cf70d79d9886c5e4cec88e5ab35223e2a8fc39cfb95097420cfb0703c4f0bab09b3b300f818ac625ffbf0d4583541

Download Submit
memory/1628-0-0x0000000002250000-0x0000000002256000-memory.dmp

Filesize
24KB

Download
memory/1628-1-0x0000000002250000-0x0000000002256000-memory.dmp

Filesize
24KB

Download
memory/1628-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/2436-23-0x00000000020E0000-0x00000000020E6000-memory.dmp

Filesize
24KB

Download