34ecbbcb5d4ec064bd3b730edc5461102dc486be13acf18339f33958a93d3fd5

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 19:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-06-04_f1d9ad0ac0248e1f012696f3d9a35318_cryptolocker.exe
Size

31KB
MD5

f1d9ad0ac0248e1f012696f3d9a35318
SHA1

14154abd332df27047f54deb5a922b344c04b44d
SHA256

34ecbbcb5d4ec064bd3b730edc5461102dc486be13acf18339f33958a93d3fd5
SHA512

b448c18cf2be3a5bc0c29267ca9972efeb1c0bee88029300bea41eb1a73013f10773e9349f1b6ff700898cccecbde457b7799c980dbb5e92468e11d632e324a8
SSDEEP

384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUGTGSG:bG74zYcgT/Ekd0ryfj8

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral2/memory/3768-0-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x000800000002343f-13.dat	CryptoLocker_rule2
behavioral2/memory/2220-16-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/3768-18-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2220-27-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	2024-06-04_f1d9ad0ac0248e1f012696f3d9a35318_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2220	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 2220	3768	2024-06-04_f1d9ad0ac0248e1f012696f3d9a35318_cryptolocker.exe	86
PID 3768 wrote to memory of 2220	3768	2024-06-04_f1d9ad0ac0248e1f012696f3d9a35318_cryptolocker.exe	86
PID 3768 wrote to memory of 2220	3768	2024-06-04_f1d9ad0ac0248e1f012696f3d9a35318_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-06-04_f1d9ad0ac0248e1f012696f3d9a35318_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-04_f1d9ad0ac0248e1f012696f3d9a35318_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
31KB

MD5
33af7d3901c590300b1fd6a1f8316772

SHA1
6db6904d13f080c1df1522c53876dede8d7e7db0

SHA256
e878be4f7336256549a0bd05a0a89888d8ee7157950a994d83f8f4bb802dce4e

SHA512
cf64ca36fef380969ebf0ee33eadd46e73f95c0095299635f824351c7c96b820cbbac3e1a176e729befe0b4f989c0ba736d475e15775d2d736ec1547e8182bac

Download Submit
memory/2220-16-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2220-26-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/2220-27-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/3768-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/3768-1-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/3768-3-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/3768-9-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/3768-18-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download