Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 18:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_3d0e9d5ac5a60da7a2cc95a1f3bbb902_cryptolocker.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-05-23_3d0e9d5ac5a60da7a2cc95a1f3bbb902_cryptolocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-23_3d0e9d5ac5a60da7a2cc95a1f3bbb902_cryptolocker.exe
-
Size
41KB
-
MD5
3d0e9d5ac5a60da7a2cc95a1f3bbb902
-
SHA1
a7d3319c0d44f4d945d677d5b3d663ced58044bf
-
SHA256
45a231cc6b5a0863ea0f5615632e919d714cba452b2ac2ba25dae9754bad9a01
-
SHA512
fe0e318efb2ab095e8ad98e3f74783d1918be54be938420b445c9d80f58026d37a7aca69a31e20c100fc9e9ab3cdd32494539c95b31824083d9ffd8676af8c6a
-
SSDEEP
768:bA74zYcgT/Ekd0ryfjPIunqpeNswmT3HwnCD:bA6YcA/X6G0W143Qs
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\hasfj.exe CryptoLocker_rule2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-05-23_3d0e9d5ac5a60da7a2cc95a1f3bbb902_cryptolocker.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 2024-05-23_3d0e9d5ac5a60da7a2cc95a1f3bbb902_cryptolocker.exe -
Executes dropped EXE 1 IoCs
Processes:
hasfj.exepid process 4324 hasfj.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-05-23_3d0e9d5ac5a60da7a2cc95a1f3bbb902_cryptolocker.exedescription pid process target process PID 2232 wrote to memory of 4324 2232 2024-05-23_3d0e9d5ac5a60da7a2cc95a1f3bbb902_cryptolocker.exe hasfj.exe PID 2232 wrote to memory of 4324 2232 2024-05-23_3d0e9d5ac5a60da7a2cc95a1f3bbb902_cryptolocker.exe hasfj.exe PID 2232 wrote to memory of 4324 2232 2024-05-23_3d0e9d5ac5a60da7a2cc95a1f3bbb902_cryptolocker.exe hasfj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_3d0e9d5ac5a60da7a2cc95a1f3bbb902_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_3d0e9d5ac5a60da7a2cc95a1f3bbb902_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
PID:4324
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4248,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:81⤵PID:2968
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\hasfj.exeFilesize
41KB
MD50c30037e081ddc4005197b721ada5c28
SHA163027f24c14ec17c1147b9b84f4b545f632d2636
SHA2566652c60a2af1d1d743ba8cfc11926833ce58ef00de723cdb839547b4d112b77d
SHA5123cc44dad6e1ff45b313e8ab89b2100d4dcf5bc1935a9e1da6829806e5c5283a459dd8e67361d43ff963737766bae6a8755b0ace5ddc848eb64c1eeea596c9701
-
memory/2232-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmpFilesize
24KB
-
memory/2232-1-0x0000000003150000-0x0000000003156000-memory.dmpFilesize
24KB
-
memory/2232-8-0x0000000002EA0000-0x0000000002EA6000-memory.dmpFilesize
24KB
-
memory/4324-17-0x00000000022C0000-0x00000000022C6000-memory.dmpFilesize
24KB
-
memory/4324-23-0x00000000005E0000-0x00000000005E6000-memory.dmpFilesize
24KB