Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 03:49

General

  • Target

    2024-05-26_a4382c7cb6ed8dcc66e116f2bea41d88_cryptolocker.exe

  • Size

    37KB

  • MD5

    a4382c7cb6ed8dcc66e116f2bea41d88

  • SHA1

    64deb3050c45b353fbbd2a8abbc3d5bbd207c465

  • SHA256

    712317968045922180b805ae86ace11c89ce237dc0ec1dc1d1b01bacdb9923be

  • SHA512

    944252ddea5b05c1191e651cb2e4b6b72c516dcf045d90cb1b54c983970f97e2996663c5433d534b755c9dbb2a578e282076d54fb8de92152e0bf91b4e0f5a8c

  • SSDEEP

    384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUqMV6U8zKvGaLigYqVwX1q6i:bA74zYcgT/Ekd0ryfj86U8zbUYqSFq6i

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-26_a4382c7cb6ed8dcc66e116f2bea41d88_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-26_a4382c7cb6ed8dcc66e116f2bea41d88_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4928
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:1308

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\hasfj.exe

          Filesize

          37KB

          MD5

          895c63111680a899c6a9a89236eef708

          SHA1

          bb76e40b9f8630defefb512b7c1f16a0c4c25315

          SHA256

          4cc276eba9b392a711c5852dfe4a84dd621cdc67e35a025636bcbb4595f95f84

          SHA512

          13320d9f5effcd4d15c07f63e71fe7c1bd1b0767235d7e5b03df9a89b30770c186b45fd741f932cd79bd4b8639a65b76a65243ce8fabc00ec95232d826d21a1a

        • memory/1308-17-0x0000000003010000-0x0000000003016000-memory.dmp

          Filesize

          24KB

        • memory/1308-23-0x0000000002D60000-0x0000000002D66000-memory.dmp

          Filesize

          24KB

        • memory/4928-0-0x00000000006D0000-0x00000000006D6000-memory.dmp

          Filesize

          24KB

        • memory/4928-8-0x00000000006D0000-0x00000000006D6000-memory.dmp

          Filesize

          24KB

        • memory/4928-1-0x0000000003150000-0x0000000003156000-memory.dmp

          Filesize

          24KB