27479ae12bd4867d8a4e6d74431af9c4893fbdb04b6b938d608ac1714594b905

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 00:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_710f5fe0f2c2e9d479debb2a9affcbe4_cryptolocker.exe
Size

33KB
MD5

710f5fe0f2c2e9d479debb2a9affcbe4
SHA1

f03b49ac33edf55a74898ae1d5c29fb36ed13994
SHA256

27479ae12bd4867d8a4e6d74431af9c4893fbdb04b6b938d608ac1714594b905
SHA512

9f61d229cd8113b4129957fc234aaae028ea44ff409369008a7f1d5fadb70bb9db3c22302858289b51d1399720b8b3cd1ccbf758b3814619ec7e33167c629364
SSDEEP

384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUGTGXvi8:bG74zYcgT/Ekd0ryfjki8

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4204-0-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2
behavioral2/memory/1336-16-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/4204-18-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/1336-27-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-22_710f5fe0f2c2e9d479debb2a9affcbe4_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	2024-05-22_710f5fe0f2c2e9d479debb2a9affcbe4_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

1336 hasfj.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1336	hasfj.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-22_710f5fe0f2c2e9d479debb2a9affcbe4_cryptolocker.exe

description	pid	process	target process
PID 4204 wrote to memory of 1336	4204	2024-05-22_710f5fe0f2c2e9d479debb2a9affcbe4_cryptolocker.exe	hasfj.exe
PID 4204 wrote to memory of 1336	4204	2024-05-22_710f5fe0f2c2e9d479debb2a9affcbe4_cryptolocker.exe	hasfj.exe
PID 4204 wrote to memory of 1336	4204	2024-05-22_710f5fe0f2c2e9d479debb2a9affcbe4_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_710f5fe0f2c2e9d479debb2a9affcbe4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_710f5fe0f2c2e9d479debb2a9affcbe4_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4204

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:1336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
33KB

MD5
f6a3f4d8a01ddaffa5c2077712085fc8

SHA1
dc63ee7ec75eb6b237ee4fbc3ba0bd3be27e5368

SHA256
c73322c54cc1869551f9b98720f00b9cb6b2879f5528ce18120a7e959697e9c7

SHA512
c5b488a5ddc62ea862a822e058af7d52c44ecef754184a9ec2260ea59afb21762fe5df3bbbb6b53de66ea6f5613c470da2db0be199b504696d0271bb5093fec3

Download Submit
memory/1336-16-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/1336-20-0x00000000007B0000-0x00000000007B6000-memory.dmp

Filesize
24KB

Download
memory/1336-26-0x0000000000780000-0x0000000000786000-memory.dmp

Filesize
24KB

Download
memory/1336-27-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/4204-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/4204-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4204-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/4204-9-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4204-18-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download