d4396335f754bdeb6c342ac2360a53b021dfb16dac85b545b13bf566da611c41

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-07_4da90eb3defee1717a51de7a18fedbf1_cryptolocker.exe
Size

391KB
MD5

4da90eb3defee1717a51de7a18fedbf1
SHA1

acbef2d47eb4afd14245393f2221d14d20347b1b
SHA256

d4396335f754bdeb6c342ac2360a53b021dfb16dac85b545b13bf566da611c41
SHA512

9b5058ffd0697ba7d51bbf6b7ae63e4a085ab9dfe9f4a5b9e00b67eecbe686146e87f201ce845c416f4af8d4305a88206da96688160647b0b015c1233b92ab90
SSDEEP

6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzXRo:nnOflT/ZFIjBz3xjTxynGUOUhXRo

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000900000002328e-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	2024-06-07_4da90eb3defee1717a51de7a18fedbf1_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
756	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 756	4392	2024-06-07_4da90eb3defee1717a51de7a18fedbf1_cryptolocker.exe	82
PID 4392 wrote to memory of 756	4392	2024-06-07_4da90eb3defee1717a51de7a18fedbf1_cryptolocker.exe	82
PID 4392 wrote to memory of 756	4392	2024-06-07_4da90eb3defee1717a51de7a18fedbf1_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-06-07_4da90eb3defee1717a51de7a18fedbf1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-07_4da90eb3defee1717a51de7a18fedbf1_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
391KB

MD5
9d034b71455dff731b5c29676d764fef

SHA1
82e14f43797d37242ccb054e4ea4d94d73f3752f

SHA256
bdf8917b5a6566512c8ba2547c33166a0be185fcd60492181764c4f0dcde844a

SHA512
32dbb603515cca234b15b99af0bb3091b4856764ccd8df46b448f6dbd7c6b5385bccbe5d1966f3aee7a89224a1c05f80eb8d48db32cc42a615ce9a23a34f920d

Download Submit
memory/756-17-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/756-23-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/4392-0-0x0000000002250000-0x0000000002256000-memory.dmp

Filesize
24KB

Download
memory/4392-1-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/4392-8-0x0000000002250000-0x0000000002256000-memory.dmp

Filesize
24KB

Download