Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/07/2024, 15:42 UTC

General

  • Target

    2024-07-06_816841ee3be543294c8011bf673a936d_cryptolocker.exe

  • Size

    43KB

  • MD5

    816841ee3be543294c8011bf673a936d

  • SHA1

    2b1a67020e7e6e467b0706933ab24c488b53570d

  • SHA256

    f068b3698c58b8258815e76859b89e4bc9fc8a6fd44088d0843f567397a9d8c0

  • SHA512

    b72ceb454e2ccac1827d6cdcee7f201fe203d7c8f0e89469c9dff9ecb648d2a16eb7858df004089ea8c5e4b2d8d7cc93a9820bd35b083083572cc026a935a286

  • SSDEEP

    384:bm74uGLLQRcsdeQ72ngEr4K7YmE8jb0nrlwfjDUadr:bm74zYcgT/EkM0ryfjPdr

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-07-06_816841ee3be543294c8011bf673a936d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-07-06_816841ee3be543294c8011bf673a936d_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1228
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:2144

Network

  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.dual-a-0034.a-msedge.net
    g-bing-com.dual-a-0034.a-msedge.net
    IN CNAME
    dual-a-0034.a-msedge.net
    dual-a-0034.a-msedge.net
    IN A
    13.107.21.237
    dual-a-0034.a-msedge.net
    IN A
    204.79.197.237
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=cebf279022c641a4a8efe6dc46820897&localId=w:A722701F-1589-5EDD-8B83-701925E7ACC0&deviceId=6755471616861629&anid=
    Remote address:
    13.107.21.237:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=cebf279022c641a4a8efe6dc46820897&localId=w:A722701F-1589-5EDD-8B83-701925E7ACC0&deviceId=6755471616861629&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=11B668B9389F6BE014FC7C0D39B86AAA; domain=.bing.com; expires=Thu, 31-Jul-2025 17:14:36 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: FEC414FAC7A041D9BEBEB0030E3E2459 Ref B: LON04EDGE0617 Ref C: 2024-07-06T17:14:36Z
    date: Sat, 06 Jul 2024 17:14:35 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=cebf279022c641a4a8efe6dc46820897&localId=w:A722701F-1589-5EDD-8B83-701925E7ACC0&deviceId=6755471616861629&anid=
    Remote address:
    13.107.21.237:443
    Request
    GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=cebf279022c641a4a8efe6dc46820897&localId=w:A722701F-1589-5EDD-8B83-701925E7ACC0&deviceId=6755471616861629&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=11B668B9389F6BE014FC7C0D39B86AAA
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=dx4ZVcuwlCZlAI7bplyqg1b80oGZqlHlMR0WEepx8Jg; domain=.bing.com; expires=Thu, 31-Jul-2025 17:14:36 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: F450B379A57549D7B390524A215A7050 Ref B: LON04EDGE0617 Ref C: 2024-07-06T17:14:36Z
    date: Sat, 06 Jul 2024 17:14:35 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=cebf279022c641a4a8efe6dc46820897&localId=w:A722701F-1589-5EDD-8B83-701925E7ACC0&deviceId=6755471616861629&anid=
    Remote address:
    13.107.21.237:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=cebf279022c641a4a8efe6dc46820897&localId=w:A722701F-1589-5EDD-8B83-701925E7ACC0&deviceId=6755471616861629&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=11B668B9389F6BE014FC7C0D39B86AAA; MSPTC=dx4ZVcuwlCZlAI7bplyqg1b80oGZqlHlMR0WEepx8Jg
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 05FD734BFC4C432486463E8649F92C1C Ref B: LON04EDGE0617 Ref C: 2024-07-06T17:14:36Z
    date: Sat, 06 Jul 2024 17:14:35 GMT
  • flag-us
    DNS
    237.21.107.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    237.21.107.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    2.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    55.36.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    55.36.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    147.142.123.92.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    147.142.123.92.in-addr.arpa
    IN PTR
    Response
    147.142.123.92.in-addr.arpa
    IN PTR
    a92-123-142-147deploystaticakamaitechnologiescom
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    14.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.227.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
  • 13.107.21.237:443
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=cebf279022c641a4a8efe6dc46820897&localId=w:A722701F-1589-5EDD-8B83-701925E7ACC0&deviceId=6755471616861629&anid=
    tls, http2
    2.0kB
    9.3kB
    22
    19

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=cebf279022c641a4a8efe6dc46820897&localId=w:A722701F-1589-5EDD-8B83-701925E7ACC0&deviceId=6755471616861629&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=cebf279022c641a4a8efe6dc46820897&localId=w:A722701F-1589-5EDD-8B83-701925E7ACC0&deviceId=6755471616861629&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=cebf279022c641a4a8efe6dc46820897&localId=w:A722701F-1589-5EDD-8B83-701925E7ACC0&deviceId=6755471616861629&anid=

    HTTP Response

    204
  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
    151 B
    1
    1

    DNS Request

    g.bing.com

    DNS Response

    13.107.21.237
    204.79.197.237

  • 8.8.8.8:53
    237.21.107.13.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    237.21.107.13.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    2.159.190.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    2.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    55.36.223.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    55.36.223.20.in-addr.arpa

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    86.23.85.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    86.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    147.142.123.92.in-addr.arpa
    dns
    73 B
    139 B
    1
    1

    DNS Request

    147.142.123.92.in-addr.arpa

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    14.227.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    14.227.111.52.in-addr.arpa

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    130 B
    1
    1

    DNS Request

    mytarta.com

  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    114 B
    260 B
    2
    2

    DNS Request

    mytarta.com

    DNS Request

    mytarta.com

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    43KB

    MD5

    77aecb3237123bad4acf248282e0ee54

    SHA1

    cb47fb5747069953cb83533fc4494a1b4cf6eed7

    SHA256

    424f4405d7c0c3255f60f5415dc91feeeb0ad49dacbb308f628815d76a442715

    SHA512

    ab2d4c8ec5c3a854500d0aacb3622c0035c2ebdef612c3460441f0c499ab7aa6f3a0448874d31117a552a2756c7bf0b642691fd1f640336c204177f12f50dbea

  • memory/1228-0-0x0000000008000000-0x000000000800D000-memory.dmp

    Filesize

    52KB

  • memory/1228-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

    Filesize

    24KB

  • memory/1228-2-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

    Filesize

    24KB

  • memory/1228-3-0x0000000003150000-0x0000000003156000-memory.dmp

    Filesize

    24KB

  • memory/1228-18-0x0000000008000000-0x000000000800D000-memory.dmp

    Filesize

    52KB

  • memory/2144-19-0x0000000003010000-0x0000000003016000-memory.dmp

    Filesize

    24KB

  • memory/2144-25-0x0000000002210000-0x0000000002216000-memory.dmp

    Filesize

    24KB

  • memory/2144-26-0x0000000008000000-0x000000000800D000-memory.dmp

    Filesize

    52KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.