8bb1f68d1c0ed1470671cb0c654d1d1b83206f00c86bc6d769b1523957f0d51b

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-25_4a6de354fdd352fb08e2b7ad12c49184_cryptolocker.exe
Size

32KB
MD5

4a6de354fdd352fb08e2b7ad12c49184
SHA1

3ccaeb8aec3c29bbb237a36fd11095e762ca5d8a
SHA256

8bb1f68d1c0ed1470671cb0c654d1d1b83206f00c86bc6d769b1523957f0d51b
SHA512

663f71ff6c6195d7db4026cd0ddbd9d6d6de7d9dfd863344fe45ec73c0d967e4dfe9f879425b39d602a4f919611ea75c35f0fe2d4c2821e9986d06a29f8a2efd
SSDEEP

384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUGTGXvm:bG74zYcgT/Ekd0ryfjkm

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral2/memory/4820-0-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x000800000002328e-13.dat	CryptoLocker_rule2
behavioral2/memory/4604-17-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/4820-18-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/4604-27-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	2024-05-25_4a6de354fdd352fb08e2b7ad12c49184_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4604	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 4604	4820	2024-05-25_4a6de354fdd352fb08e2b7ad12c49184_cryptolocker.exe	83
PID 4820 wrote to memory of 4604	4820	2024-05-25_4a6de354fdd352fb08e2b7ad12c49184_cryptolocker.exe	83
PID 4820 wrote to memory of 4604	4820	2024-05-25_4a6de354fdd352fb08e2b7ad12c49184_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-05-25_4a6de354fdd352fb08e2b7ad12c49184_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-25_4a6de354fdd352fb08e2b7ad12c49184_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:4604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
32KB

MD5
c58690d50a1082393efd94e44674a7ed

SHA1
5e28d76e20593a2e8240ffb8b16418842f349f8d

SHA256
39e57ee13127d8f329ca599c9564a4ed7acf833199c7db664df6f8242577d162

SHA512
81c93be92f0946479a474f32a620d7df5f14eff4f167564d8ffd02670468d5d0e1812bc5f97ccbf13139183af7377b3179ea17467fca6b1036a38fa507c1ba4a

Download Submit
memory/4604-17-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/4604-20-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/4604-26-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download
memory/4604-27-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/4820-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/4820-1-0x00000000006F0000-0x00000000006F6000-memory.dmp

Filesize
24KB

Download
memory/4820-2-0x0000000000720000-0x0000000000726000-memory.dmp

Filesize
24KB

Download
memory/4820-9-0x00000000006F0000-0x00000000006F6000-memory.dmp

Filesize
24KB

Download
memory/4820-18-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download