094ddad5a7c84cce0afbe8e19836e263cd4cf11bc52397135a29982b42886fdd

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 22:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-25_803687ebbc6fe8709d6e8989f5435f32_cryptolocker.exe
Size

32KB
MD5

803687ebbc6fe8709d6e8989f5435f32
SHA1

ae3d50f893240ce26dea5675587bee459e51e46e
SHA256

094ddad5a7c84cce0afbe8e19836e263cd4cf11bc52397135a29982b42886fdd
SHA512

50fc337fb6cfd97d430b02df77b722457cd2a72bc999ba183a9bd53c6bd34e503cc6355161df8d511b8b53146ec3b85c4d1e47b915396f42ea3be5de93b4d689
SSDEEP

384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUGTGXua6:bG74zYcgT/Ekd0ryfjL

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/4288-0-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x0007000000023297-13.dat	CryptoLocker_rule2
behavioral2/memory/4288-17-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/1752-26-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	2024-05-25_803687ebbc6fe8709d6e8989f5435f32_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1752	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 1752	4288	2024-05-25_803687ebbc6fe8709d6e8989f5435f32_cryptolocker.exe	82
PID 4288 wrote to memory of 1752	4288	2024-05-25_803687ebbc6fe8709d6e8989f5435f32_cryptolocker.exe	82
PID 4288 wrote to memory of 1752	4288	2024-05-25_803687ebbc6fe8709d6e8989f5435f32_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-05-25_803687ebbc6fe8709d6e8989f5435f32_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-25_803687ebbc6fe8709d6e8989f5435f32_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
32KB

MD5
f2c8942ad4202dcace22d6d322e52ddb

SHA1
f9bef218ed23df78fa44ae03866f0062434f2c76

SHA256
6393a800020dd26b1ab29f9da49fba5f39587efe180444388c0866fe52cd14ec

SHA512
71814262bb8ca6cd96c668c9e586a61056fef3fccb14f03bd21f0b93a080dfe084de3b2aed0ea25e83d87ff5974513562cb29342fd38b4368c140df8cc49ff59

Download Submit
memory/1752-25-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/1752-26-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/4288-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/4288-1-0x0000000002250000-0x0000000002256000-memory.dmp

Filesize
24KB

Download
memory/4288-9-0x0000000002250000-0x0000000002256000-memory.dmp

Filesize
24KB

Download
memory/4288-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/4288-17-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download