Analysis

  • max time kernel
    126s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/06/2024, 07:34

General

  • Target

    2024-06-09_b2e65c6612e492dd5a6dde83c8bcc69d_cryptolocker.exe

  • Size

    43KB

  • MD5

    b2e65c6612e492dd5a6dde83c8bcc69d

  • SHA1

    26daaf9dfcb3dbf107df4b4f108231a2790f4b5e

  • SHA256

    58a72dbd3104b672f2d0d2f4ea941a9eb5a9edd695b987058e71a62cf10f6777

  • SHA512

    5f3318d102262a19b3822361bf92875c1e841c4ab9d9bd06e14242488c73561318d96a48b787a550fdf86d9624047e557c191b5af5845513ce1af8fca4200471

  • SSDEEP

    384:bm74uGLLQRcsdeQ72ngEr4K7YmE8jb0nrlwfjDUkP:bm74zYcgT/EkM0ryfjdP

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-09_b2e65c6612e492dd5a6dde83c8bcc69d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-09_b2e65c6612e492dd5a6dde83c8bcc69d_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4804
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:4444

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    43KB

    MD5

    7d06580faa717ce35a4ee67fd30f608b

    SHA1

    d9331245195b818c6d71768d132c961be98ea3d8

    SHA256

    61ee492bb71ed3357a9edc92fa7941d9c419969d122ecd88210bc3bd159055d2

    SHA512

    8c0f257a46003eafbada48d8b2ffbfc120f1858d5e8d1f845ca1c8a6722bb61ed987cd8327afcb7d72b8ad32b8ca644372b2809d08ef27cba8ce5343940525f2

  • memory/4444-17-0x0000000008000000-0x000000000800D000-memory.dmp

    Filesize

    52KB

  • memory/4444-20-0x00000000022C0000-0x00000000022C6000-memory.dmp

    Filesize

    24KB

  • memory/4444-26-0x0000000002110000-0x0000000002116000-memory.dmp

    Filesize

    24KB

  • memory/4444-27-0x0000000008000000-0x000000000800D000-memory.dmp

    Filesize

    52KB

  • memory/4804-0-0x0000000008000000-0x000000000800D000-memory.dmp

    Filesize

    52KB

  • memory/4804-1-0x0000000002D60000-0x0000000002D66000-memory.dmp

    Filesize

    24KB

  • memory/4804-2-0x0000000003010000-0x0000000003016000-memory.dmp

    Filesize

    24KB

  • memory/4804-9-0x0000000002D60000-0x0000000002D66000-memory.dmp

    Filesize

    24KB

  • memory/4804-18-0x0000000008000000-0x000000000800D000-memory.dmp

    Filesize

    52KB