Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 04:48
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-04_86627b3c319ef72005a5b3afc66db786_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-04_86627b3c319ef72005a5b3afc66db786_cryptolocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-04_86627b3c319ef72005a5b3afc66db786_cryptolocker.exe
-
Size
45KB
-
MD5
86627b3c319ef72005a5b3afc66db786
-
SHA1
77d7134894b5f0af7ba0c018a7539fa2a8f152af
-
SHA256
f05f8edaf2fe72a4e166a7642b4cb0174a407cae764e389eb7f35e74cd748b73
-
SHA512
fae39023e324ad3d3892ce1008fa773b7a4abbba161eb1a8d143159218b61df8b8f697d4d36c5a752897afa7a43a0adbfcd26164f77a3afab1e81679fac5f987
-
SSDEEP
384:bm74uGLLQRcsdeQ72ngEr4K7YmE8jb0nrlwfjDUadQC8F:bm74zYcgT/EkM0ryfjPdQZF
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
resource yara_rule behavioral2/memory/2212-0-0x0000000008000000-0x000000000800D000-memory.dmp CryptoLocker_rule2 behavioral2/files/0x0008000000023430-13.dat CryptoLocker_rule2 behavioral2/memory/2212-17-0x0000000008000000-0x000000000800D000-memory.dmp CryptoLocker_rule2 behavioral2/memory/2472-25-0x0000000008000000-0x000000000800D000-memory.dmp CryptoLocker_rule2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 2024-06-04_86627b3c319ef72005a5b3afc66db786_cryptolocker.exe -
Executes dropped EXE 1 IoCs
pid Process 2472 hasfj.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2472 2212 2024-06-04_86627b3c319ef72005a5b3afc66db786_cryptolocker.exe 82 PID 2212 wrote to memory of 2472 2212 2024-06-04_86627b3c319ef72005a5b3afc66db786_cryptolocker.exe 82 PID 2212 wrote to memory of 2472 2212 2024-06-04_86627b3c319ef72005a5b3afc66db786_cryptolocker.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-04_86627b3c319ef72005a5b3afc66db786_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-04_86627b3c319ef72005a5b3afc66db786_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
PID:2472
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD543b27702674a2ad6b1ba61b3ed6bf9f5
SHA1743ff232acada8d48f7247d0e6c73902abe15cf4
SHA2566568e02bf011a013c5bb9fa1c27cbfd34c1ae9937870476df74ea43371539c1a
SHA512a72217a37ba37e7b86f9a5702607c32e5e8882e6c607baa2b59c5739ee8ebe049ea282e7dd5d55db7afb247b8a10a0e0e4805ee11cac07fd47ab1c716195fd87