b943cddde6610f7f3e4a503c3e84c66ae49eb384df6a5850fd5a383d362da947

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_3ec81babe1e673a4bd9a412fce5483cd_cryptolocker.exe
Size

24KB
MD5

3ec81babe1e673a4bd9a412fce5483cd
SHA1

29895035057e1f160c5a8b904e061ebf4460074d
SHA256

b943cddde6610f7f3e4a503c3e84c66ae49eb384df6a5850fd5a383d362da947
SHA512

634313708a4d149d33242bb042c94e2153b3010a7383f87f6b523285aa41a82cbc8433d2ecc577254baf5bd1cc4d75b32c62fb9842ef8307f756b9abdf3d8186
SSDEEP

384:bVCPwFRuFn65arz1ZhdaXFXSCVQTLfjDp6HMJ2o:bVCPwFRo6CpwXFXSqQXfjAsJ7

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4632-0-0x0000000008000000-0x000000000800E000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2
behavioral2/memory/4632-17-0x0000000008000000-0x000000000800E000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/1592-18-0x0000000008000000-0x000000000800E000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/1592-27-0x0000000008000000-0x000000000800E000-memory.dmp	CryptoLocker_rule2

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4632-0-0x0000000008000000-0x000000000800E000-memory.dmp	UPX
C:\Users\Admin\AppData\Local\Temp\hasfj.exe	UPX
behavioral2/memory/4632-17-0x0000000008000000-0x000000000800E000-memory.dmp	UPX
behavioral2/memory/1592-18-0x0000000008000000-0x000000000800E000-memory.dmp	UPX
behavioral2/memory/1592-27-0x0000000008000000-0x000000000800E000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-23_3ec81babe1e673a4bd9a412fce5483cd_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	2024-05-23_3ec81babe1e673a4bd9a412fce5483cd_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

1592 hasfj.exe

pid	process
1592	hasfj.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4632-0-0x0000000008000000-0x000000000800E000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\hasfj.exe	upx
behavioral2/memory/4632-17-0x0000000008000000-0x000000000800E000-memory.dmp	upx
behavioral2/memory/1592-18-0x0000000008000000-0x000000000800E000-memory.dmp	upx
behavioral2/memory/1592-27-0x0000000008000000-0x000000000800E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-23_3ec81babe1e673a4bd9a412fce5483cd_cryptolocker.exe

description	pid	process	target process
PID 4632 wrote to memory of 1592	4632	2024-05-23_3ec81babe1e673a4bd9a412fce5483cd_cryptolocker.exe	hasfj.exe
PID 4632 wrote to memory of 1592	4632	2024-05-23_3ec81babe1e673a4bd9a412fce5483cd_cryptolocker.exe	hasfj.exe
PID 4632 wrote to memory of 1592	4632	2024-05-23_3ec81babe1e673a4bd9a412fce5483cd_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_3ec81babe1e673a4bd9a412fce5483cd_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_3ec81babe1e673a4bd9a412fce5483cd_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4632

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:1592

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
Filesize
24KB

MD5
75228cdb6b494cbc99ea9bc65fa94dbe

SHA1
f704dd98d311e56c91921fa2515bfa23257615bd

SHA256
3b521837c71c25e5a0a07b5d6461bcc82435f00c2a93cf095039acd5a2aac522

SHA512
a4221b804dde9ddc947f7bba6cd6ce4b3556d8e896f4abf434d5364e2fa957c4fddc74c87a8fd56bb9e90bc793884d43406b67e1a1b220c2335077ad76a4ddaa

Download Submit
memory/1592-18-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download
memory/1592-20-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/1592-26-0x0000000002180000-0x0000000002186000-memory.dmp

Filesize
24KB

Download
memory/1592-27-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download
memory/4632-0-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download
memory/4632-1-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download
memory/4632-2-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/4632-9-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download
memory/4632-17-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download