6eefe440284537f1424c25bb27bbdb2fa1a7f780a06d0c8719b28b4481c06988

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

202405241ce4e3f709582778b791b3849d28c58dcryptolocker.exe
Size

40KB
MD5

1ce4e3f709582778b791b3849d28c58d
SHA1

22de1a1d5bca65a082852a988ba7219537684eef
SHA256

6eefe440284537f1424c25bb27bbdb2fa1a7f780a06d0c8719b28b4481c06988
SHA512

6c04a2240d0cd374974070767064e5fcc57153ce18d9879f93774498a58de4788c7ae20a42ff1b8e4bd8bf1bf4af33d9cd0a8912600f39a2605de52bc8b61c4d
SSDEEP

768:bA74zYcgT/Ekd0ryfjPIunqpeNswmT3Hw2A4362R:bA6YcA/X6G0W143QlAR

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	202405241ce4e3f709582778b791b3849d28c58dcryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1396	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 1396	2900	202405241ce4e3f709582778b791b3849d28c58dcryptolocker.exe	83
PID 2900 wrote to memory of 1396	2900	202405241ce4e3f709582778b791b3849d28c58dcryptolocker.exe	83
PID 2900 wrote to memory of 1396	2900	202405241ce4e3f709582778b791b3849d28c58dcryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\202405241ce4e3f709582778b791b3849d28c58dcryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\202405241ce4e3f709582778b791b3849d28c58dcryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
40KB

MD5
dcee492f021f076a5d8607c467fd0b63

SHA1
5afff36af20cec533f0606a6ed7093d4daa9cfd9

SHA256
ded1aa2d77d71ccdea597d0efbdc39bb56b801d016e1590187906703b1f8a059

SHA512
141a680d2d41a5476fb41765abd572d8ad7104ed631a83b795ad0c561cc23c5f0ae29e760bad53fd072b96f40f96bfe8331324e491111855fc189c6f1f15490a

Download Submit
memory/1396-23-0x0000000002010000-0x0000000002016000-memory.dmp

Filesize
24KB

Download
memory/1396-17-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/2900-0-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/2900-1-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/2900-8-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download