9c6624bc16cf70c9d0da1e81bc003d85c61c4bc07f65e280076a40cb83da78b3

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_30ee2f276c96c14bd7d8676271fc682d_cryptolocker.exe
Size

36KB
MD5

30ee2f276c96c14bd7d8676271fc682d
SHA1

971de9570847860ae761043e6743bfdb89f7ea63
SHA256

9c6624bc16cf70c9d0da1e81bc003d85c61c4bc07f65e280076a40cb83da78b3
SHA512

c7a96c742806bfadb239943bd023b51ecd7bd2873a654b8f0a229d992348fb0ffd6f8a7ad9f47d61e074fdac4d18c12561314ec8a69860d121e261e35bfeecd7
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUgIunIVpeNs23mAA6lx1hg:bA74zYcgT/Ekd0ryfjPIunqpeNswm60

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-23_30ee2f276c96c14bd7d8676271fc682d_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	2024-05-23_30ee2f276c96c14bd7d8676271fc682d_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

2320 hasfj.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2320	hasfj.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-23_30ee2f276c96c14bd7d8676271fc682d_cryptolocker.exe

description	pid	process	target process
PID 2840 wrote to memory of 2320	2840	2024-05-23_30ee2f276c96c14bd7d8676271fc682d_cryptolocker.exe	hasfj.exe
PID 2840 wrote to memory of 2320	2840	2024-05-23_30ee2f276c96c14bd7d8676271fc682d_cryptolocker.exe	hasfj.exe
PID 2840 wrote to memory of 2320	2840	2024-05-23_30ee2f276c96c14bd7d8676271fc682d_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_30ee2f276c96c14bd7d8676271fc682d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_30ee2f276c96c14bd7d8676271fc682d_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2840

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:2320

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
Filesize
36KB

MD5
dca764b3b5e105da37604201b75cc0a1

SHA1
420cd494acb50c55d63a87753796313c4d24e271

SHA256
0c98c6a63d217a6d17374cd05e5394182131a759c5ae7ff12846f406a366c30b

SHA512
dd2d9277cbc6f033014d31da055cc23fccb73dd0046f943560263b792096510740876144d708c3a572395bcf554d231189c46fc036d05ab6d60002a716c4c640

Download Submit
memory/2320-23-0x0000000002120000-0x0000000002126000-memory.dmp

Filesize
24KB

Download
memory/2320-17-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download
memory/2840-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/2840-1-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/2840-8-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download