Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2024, 15:42 UTC
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-06_816841ee3be543294c8011bf673a936d_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-07-06_816841ee3be543294c8011bf673a936d_cryptolocker.exe
Resource
win10v2004-20240704-en
General
-
Target
2024-07-06_816841ee3be543294c8011bf673a936d_cryptolocker.exe
-
Size
43KB
-
MD5
816841ee3be543294c8011bf673a936d
-
SHA1
2b1a67020e7e6e467b0706933ab24c488b53570d
-
SHA256
f068b3698c58b8258815e76859b89e4bc9fc8a6fd44088d0843f567397a9d8c0
-
SHA512
b72ceb454e2ccac1827d6cdcee7f201fe203d7c8f0e89469c9dff9ecb648d2a16eb7858df004089ea8c5e4b2d8d7cc93a9820bd35b083083572cc026a935a286
-
SSDEEP
384:bm74uGLLQRcsdeQ72ngEr4K7YmE8jb0nrlwfjDUadr:bm74zYcgT/EkM0ryfjPdr
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\Control Panel\International\Geo\Nation 2024-07-06_816841ee3be543294c8011bf673a936d_cryptolocker.exe -
Executes dropped EXE 1 IoCs
pid Process 2144 hasfj.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1228 wrote to memory of 2144 1228 2024-07-06_816841ee3be543294c8011bf673a936d_cryptolocker.exe 85 PID 1228 wrote to memory of 2144 1228 2024-07-06_816841ee3be543294c8011bf673a936d_cryptolocker.exe 85 PID 1228 wrote to memory of 2144 1228 2024-07-06_816841ee3be543294c8011bf673a936d_cryptolocker.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_816841ee3be543294c8011bf673a936d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-06_816841ee3be543294c8011bf673a936d_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
PID:2144
-
Network
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.dual-a-0034.a-msedge.netg-bing-com.dual-a-0034.a-msedge.netIN CNAMEdual-a-0034.a-msedge.netdual-a-0034.a-msedge.netIN A13.107.21.237dual-a-0034.a-msedge.netIN A204.79.197.237
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=cebf279022c641a4a8efe6dc46820897&localId=w:A722701F-1589-5EDD-8B83-701925E7ACC0&deviceId=6755471616861629&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=cebf279022c641a4a8efe6dc46820897&localId=w:A722701F-1589-5EDD-8B83-701925E7ACC0&deviceId=6755471616861629&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=11B668B9389F6BE014FC7C0D39B86AAA; domain=.bing.com; expires=Thu, 31-Jul-2025 17:14:36 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: FEC414FAC7A041D9BEBEB0030E3E2459 Ref B: LON04EDGE0617 Ref C: 2024-07-06T17:14:36Z
date: Sat, 06 Jul 2024 17:14:35 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=cebf279022c641a4a8efe6dc46820897&localId=w:A722701F-1589-5EDD-8B83-701925E7ACC0&deviceId=6755471616861629&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=cebf279022c641a4a8efe6dc46820897&localId=w:A722701F-1589-5EDD-8B83-701925E7ACC0&deviceId=6755471616861629&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=11B668B9389F6BE014FC7C0D39B86AAA
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=dx4ZVcuwlCZlAI7bplyqg1b80oGZqlHlMR0WEepx8Jg; domain=.bing.com; expires=Thu, 31-Jul-2025 17:14:36 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F450B379A57549D7B390524A215A7050 Ref B: LON04EDGE0617 Ref C: 2024-07-06T17:14:36Z
date: Sat, 06 Jul 2024 17:14:35 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=cebf279022c641a4a8efe6dc46820897&localId=w:A722701F-1589-5EDD-8B83-701925E7ACC0&deviceId=6755471616861629&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=cebf279022c641a4a8efe6dc46820897&localId=w:A722701F-1589-5EDD-8B83-701925E7ACC0&deviceId=6755471616861629&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=11B668B9389F6BE014FC7C0D39B86AAA; MSPTC=dx4ZVcuwlCZlAI7bplyqg1b80oGZqlHlMR0WEepx8Jg
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 05FD734BFC4C432486463E8649F92C1C Ref B: LON04EDGE0617 Ref C: 2024-07-06T17:14:36Z
date: Sat, 06 Jul 2024 17:14:35 GMT
-
Remote address:8.8.8.8:53Request237.21.107.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request2.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request55.36.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Request147.142.123.92.in-addr.arpaIN PTRResponse147.142.123.92.in-addr.arpaIN PTRa92-123-142-147deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
Remote address:8.8.8.8:53Requestmytarta.comIN AResponse
-
13.107.21.237:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=cebf279022c641a4a8efe6dc46820897&localId=w:A722701F-1589-5EDD-8B83-701925E7ACC0&deviceId=6755471616861629&anid=tls, http22.0kB 9.3kB 22 19
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=cebf279022c641a4a8efe6dc46820897&localId=w:A722701F-1589-5EDD-8B83-701925E7ACC0&deviceId=6755471616861629&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=cebf279022c641a4a8efe6dc46820897&localId=w:A722701F-1589-5EDD-8B83-701925E7ACC0&deviceId=6755471616861629&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=cebf279022c641a4a8efe6dc46820897&localId=w:A722701F-1589-5EDD-8B83-701925E7ACC0&deviceId=6755471616861629&anid=HTTP Response
204
-
56 B 151 B 1 1
DNS Request
g.bing.com
DNS Response
13.107.21.237204.79.197.237
-
72 B 158 B 1 1
DNS Request
237.21.107.13.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
2.159.190.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
55.36.223.20.in-addr.arpa
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
70 B 144 B 1 1
DNS Request
86.23.85.13.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
73 B 139 B 1 1
DNS Request
147.142.123.92.in-addr.arpa
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
72 B 158 B 1 1
DNS Request
14.227.111.52.in-addr.arpa
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
57 B 130 B 1 1
DNS Request
mytarta.com
-
114 B 260 B 2 2
DNS Request
mytarta.com
DNS Request
mytarta.com
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD577aecb3237123bad4acf248282e0ee54
SHA1cb47fb5747069953cb83533fc4494a1b4cf6eed7
SHA256424f4405d7c0c3255f60f5415dc91feeeb0ad49dacbb308f628815d76a442715
SHA512ab2d4c8ec5c3a854500d0aacb3622c0035c2ebdef612c3460441f0c499ab7aa6f3a0448874d31117a552a2756c7bf0b642691fd1f640336c204177f12f50dbea