bf703cca141eca33bb727f7550bf64df3c8546861f8145a8bcdc84eaecf680fc

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20240521c24f2116d42a9e3300512dcf163fb0c5cryptolocker.exe
Size

44KB
MD5

c24f2116d42a9e3300512dcf163fb0c5
SHA1

c0d5bcad9a7c1a620860841aeb567f61f39cc884
SHA256

bf703cca141eca33bb727f7550bf64df3c8546861f8145a8bcdc84eaecf680fc
SHA512

262e3676b4ec9e6301d8537f23c480df9dd5d246b8595d67c7d821abf1c47f2d5d3129eb670b3ff2aef2908521e1679293ad4c5579353f8228116efbccd15c78
SSDEEP

384:bm74uGLLQRcsdeQ72ngEr4K7YmE8jo0nrlwfjDUpEui0U3Nf+b:bm74zYcgT/Ekn0ryfjLur

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

20240521c24f2116d42a9e3300512dcf163fb0c5cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	20240521c24f2116d42a9e3300512dcf163fb0c5cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

1372 hasfj.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1372	hasfj.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

20240521c24f2116d42a9e3300512dcf163fb0c5cryptolocker.exe

description	pid	process	target process
PID 1160 wrote to memory of 1372	1160	20240521c24f2116d42a9e3300512dcf163fb0c5cryptolocker.exe	hasfj.exe
PID 1160 wrote to memory of 1372	1160	20240521c24f2116d42a9e3300512dcf163fb0c5cryptolocker.exe	hasfj.exe
PID 1160 wrote to memory of 1372	1160	20240521c24f2116d42a9e3300512dcf163fb0c5cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\20240521c24f2116d42a9e3300512dcf163fb0c5cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\20240521c24f2116d42a9e3300512dcf163fb0c5cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
44KB

MD5
47d5a026c133aa85a95b1d68c84ac2d8

SHA1
14c47b2b5e4362d7d1a3053d3a2b99e83c27a7fd

SHA256
2bcbe2a1daf3800011539428665c0287641820ab16bc6110501c372a6a7daec3

SHA512
936a49f1034bc1d0c453f4a0d8fb76f0c6d0aa5963685ad809fbedb8ebc805cc90e8e0339651d11df18c33568ff6455c87b20a9be3612f349e844f9d6dcf3d0e

Download Submit
memory/1160-0-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/1160-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/1160-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/1160-9-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/1160-18-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/1372-16-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/1372-20-0x00000000021C0000-0x00000000021C6000-memory.dmp

Filesize
24KB

Download
memory/1372-26-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/1372-27-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download