Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 02:22
Behavioral task
behavioral1
Sample
2024-05-23_0cd7e81faf9c27f078ec2bce27242d2c_cryptolocker.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-05-23_0cd7e81faf9c27f078ec2bce27242d2c_cryptolocker.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-05-23_0cd7e81faf9c27f078ec2bce27242d2c_cryptolocker.exe
-
Size
24KB
-
MD5
0cd7e81faf9c27f078ec2bce27242d2c
-
SHA1
ca2ff83a6b5419544506d35b330ccd3641084f36
-
SHA256
db0420194c3838bbe6594eb967885752838b09946e57e76c300a576061c986db
-
SHA512
b19126af58903c9110d39366003668871d1ecf81cd1574355be92d857f2b5fac7f8beecf7d7ef984143d5cd05264a505627862cd436e95ce0d4b24d78774e6e6
-
SSDEEP
384:bVCPwFRuFn65arz1ZhdaXFXSCVQTLfjDp6HMJ2C:bVCPwFRo6CpwXFXSqQXfjAsJ9
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2916-0-0x0000000008000000-0x000000000800E000-memory.dmp CryptoLocker_rule2 C:\Users\Admin\AppData\Local\Temp\hasfj.exe CryptoLocker_rule2 behavioral2/memory/2916-19-0x0000000008000000-0x000000000800E000-memory.dmp CryptoLocker_rule2 behavioral2/memory/4920-27-0x0000000008000000-0x000000000800E000-memory.dmp CryptoLocker_rule2 -
UPX dump on OEP (original entry point) 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2916-0-0x0000000008000000-0x000000000800E000-memory.dmp UPX C:\Users\Admin\AppData\Local\Temp\hasfj.exe UPX behavioral2/memory/2916-19-0x0000000008000000-0x000000000800E000-memory.dmp UPX behavioral2/memory/4920-27-0x0000000008000000-0x000000000800E000-memory.dmp UPX -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-05-23_0cd7e81faf9c27f078ec2bce27242d2c_cryptolocker.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 2024-05-23_0cd7e81faf9c27f078ec2bce27242d2c_cryptolocker.exe -
Executes dropped EXE 1 IoCs
Processes:
hasfj.exepid process 4920 hasfj.exe -
Processes:
resource yara_rule behavioral2/memory/2916-0-0x0000000008000000-0x000000000800E000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\hasfj.exe upx behavioral2/memory/2916-19-0x0000000008000000-0x000000000800E000-memory.dmp upx behavioral2/memory/4920-27-0x0000000008000000-0x000000000800E000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-05-23_0cd7e81faf9c27f078ec2bce27242d2c_cryptolocker.exedescription pid process target process PID 2916 wrote to memory of 4920 2916 2024-05-23_0cd7e81faf9c27f078ec2bce27242d2c_cryptolocker.exe hasfj.exe PID 2916 wrote to memory of 4920 2916 2024-05-23_0cd7e81faf9c27f078ec2bce27242d2c_cryptolocker.exe hasfj.exe PID 2916 wrote to memory of 4920 2916 2024-05-23_0cd7e81faf9c27f078ec2bce27242d2c_cryptolocker.exe hasfj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_0cd7e81faf9c27f078ec2bce27242d2c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_0cd7e81faf9c27f078ec2bce27242d2c_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4832 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\hasfj.exeFilesize
24KB
MD507099e91790eb8dceb7f4f84c01b3dc7
SHA1f4c115b51edfe93ee34a1a69d72219e34f3cdb23
SHA256742b9e0c76806a5b630f26e112126270b4320f90037fa235c1c14627028c6272
SHA512b0d6a4a26959724c4004cffb14452cdf512638ccb8d6de49f55a89cc3cd79971f0c2a6b68faad88ab917adc5094413c3fb10fc54cf6cbe24dabec6735e799cd6
-
memory/2916-0-0x0000000008000000-0x000000000800E000-memory.dmpFilesize
56KB
-
memory/2916-1-0x00000000020E0000-0x00000000020E6000-memory.dmpFilesize
24KB
-
memory/2916-2-0x00000000020E0000-0x00000000020E6000-memory.dmpFilesize
24KB
-
memory/2916-3-0x0000000003150000-0x0000000003156000-memory.dmpFilesize
24KB
-
memory/2916-19-0x0000000008000000-0x000000000800E000-memory.dmpFilesize
56KB
-
memory/4920-22-0x0000000002D60000-0x0000000002D66000-memory.dmpFilesize
24KB
-
memory/4920-20-0x0000000002ED0000-0x0000000002ED6000-memory.dmpFilesize
24KB
-
memory/4920-27-0x0000000008000000-0x000000000800E000-memory.dmpFilesize
56KB