99c7bbcea5acae79bcdef43268944d14b7f09f34da37f0a2c0287fd9e60ca434

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 10:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-25_32cdf598770921f66574f3ae4e4d40dd_cryptolocker.exe
Size

45KB
MD5

32cdf598770921f66574f3ae4e4d40dd
SHA1

49ce60fcbe2cb1d82628a12ca4713e41abde9370
SHA256

99c7bbcea5acae79bcdef43268944d14b7f09f34da37f0a2c0287fd9e60ca434
SHA512

665bb12bfcdcfb5b08a1e1b12e2b8364e3d61c0c8992714e2b303a03f7c396b470dc80f04511aeae6b74731d11749bd02b00297547f13b8ffaa353f730969326
SSDEEP

384:bm74uGLLQRcsdeQ72ngEr4K7YmE8jb0nrlwfjDUk3r:bm74zYcgT/EkM0ryfjd3r

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	2024-06-25_32cdf598770921f66574f3ae4e4d40dd_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
848	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 848	1328	2024-06-25_32cdf598770921f66574f3ae4e4d40dd_cryptolocker.exe	81
PID 1328 wrote to memory of 848	1328	2024-06-25_32cdf598770921f66574f3ae4e4d40dd_cryptolocker.exe	81
PID 1328 wrote to memory of 848	1328	2024-06-25_32cdf598770921f66574f3ae4e4d40dd_cryptolocker.exe	81

C:\Users\Admin\AppData\Local\Temp\2024-06-25_32cdf598770921f66574f3ae4e4d40dd_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-25_32cdf598770921f66574f3ae4e4d40dd_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
45KB

MD5
0bc07c67d6e28cce043efa923910db14

SHA1
03106cfa502ae1c707109d427e31d1b76fc77a35

SHA256
eb834bf80be955344ce36fdb0007911ceed6d4dff8ab5d97378fd7abc88cc3b8

SHA512
2b9840d121db4355dae7fc3c8e7b7ad3fabd282265eb52164f2ae9a01f6dbdb9e9be8dc8469601c87b9b2ff74080c362ecbf9e7c2e109730fad9802acd71da80

Download Submit
memory/848-19-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/848-25-0x0000000002090000-0x0000000002096000-memory.dmp

Filesize
24KB

Download
memory/848-26-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/1328-0-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/1328-1-0x0000000000740000-0x0000000000746000-memory.dmp

Filesize
24KB

Download
memory/1328-2-0x0000000002280000-0x0000000002286000-memory.dmp

Filesize
24KB

Download
memory/1328-9-0x0000000000740000-0x0000000000746000-memory.dmp

Filesize
24KB

Download
memory/1328-17-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download