6e821fe0e04cc52fac232c79a47a0b4b6b2044216bb11c4e86dda6f570388b41

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

202405216e9f1a0dde7c8f26b1d0f867496e73b1cryptolocker.exe
Size

42KB
MD5

6e9f1a0dde7c8f26b1d0f867496e73b1
SHA1

cf46b99b2c52666ee50e5d9ec463121805ecf201
SHA256

6e821fe0e04cc52fac232c79a47a0b4b6b2044216bb11c4e86dda6f570388b41
SHA512

d2290cee43739702210b88c9891b613f2e2c112ebee4c6fe5301c826947b17b3fb43a1d1fcb5a184e2ad83f2fefbe9bc3c9c6220a0bc1c1a127af946cb451a27
SSDEEP

768:ba74zYcgT/EkdCQgpwXFXSqQXfj0xKoWO/:ba6YcA/Xk3wXFXSqAJi/

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

202405216e9f1a0dde7c8f26b1d0f867496e73b1cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	202405216e9f1a0dde7c8f26b1d0f867496e73b1cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

4912 hasfj.exe

pid	process
4912	hasfj.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/868-0-0x0000000008000000-0x000000000800F000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\hasfj.exe	upx
behavioral2/memory/868-17-0x0000000008000000-0x000000000800F000-memory.dmp	upx
behavioral2/memory/4912-26-0x0000000008000000-0x000000000800F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

202405216e9f1a0dde7c8f26b1d0f867496e73b1cryptolocker.exe

description	pid	process	target process
PID 868 wrote to memory of 4912	868	202405216e9f1a0dde7c8f26b1d0f867496e73b1cryptolocker.exe	hasfj.exe
PID 868 wrote to memory of 4912	868	202405216e9f1a0dde7c8f26b1d0f867496e73b1cryptolocker.exe	hasfj.exe
PID 868 wrote to memory of 4912	868	202405216e9f1a0dde7c8f26b1d0f867496e73b1cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\202405216e9f1a0dde7c8f26b1d0f867496e73b1cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\202405216e9f1a0dde7c8f26b1d0f867496e73b1cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:868
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
42KB

MD5
fc29f0981d27dc7c60d91b65f6769e9b

SHA1
da98cc367e6c32df75d277af118c72d44ad6dd55

SHA256
27aeb0f8a798199a1873353004352a476c1a63a5e40368d5599e938d02d71bb0

SHA512
e4213a7fb15ae49ae6ebaa69bcb22d0cf96e18ac0d74cda655006e8ba62adde8efcae098381695b280d0a57d0352daef7c5621659ac3447133934b9009ccb52c

Download Submit
memory/868-0-0x0000000008000000-0x000000000800F000-memory.dmp

Filesize
60KB

Download
memory/868-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/868-2-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/868-3-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/868-17-0x0000000008000000-0x000000000800F000-memory.dmp

Filesize
60KB

Download
memory/4912-25-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/4912-19-0x0000000002280000-0x0000000002286000-memory.dmp

Filesize
24KB

Download
memory/4912-26-0x0000000008000000-0x000000000800F000-memory.dmp

Filesize
60KB

Download