6677cff984e9227f04a060e6df8789c306cdb002851ad1ad0d40bbc04edd7c71

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-10_2c637167fd0ed3630f0335150b4ee848_cryptolocker.exe
Size

393KB
MD5

2c637167fd0ed3630f0335150b4ee848
SHA1

2ed4e5a3d2b49784d6d6ad7a867c99c53041a111
SHA256

6677cff984e9227f04a060e6df8789c306cdb002851ad1ad0d40bbc04edd7c71
SHA512

3192369887e31ff4bd216abd42adbe7e8915721f20617eef32f1e1be0fe74bb2335eb70b224767452a856bcabfd679c141e9d8e4f944e19370e88dbd27b973eb
SSDEEP

6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzXR5:nnOflT/ZFIjBz3xjTxynGUOUhXR5

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	2024-07-10_2c637167fd0ed3630f0335150b4ee848_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2368	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2368	2376	2024-07-10_2c637167fd0ed3630f0335150b4ee848_cryptolocker.exe	85
PID 2376 wrote to memory of 2368	2376	2024-07-10_2c637167fd0ed3630f0335150b4ee848_cryptolocker.exe	85
PID 2376 wrote to memory of 2368	2376	2024-07-10_2c637167fd0ed3630f0335150b4ee848_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-07-10_2c637167fd0ed3630f0335150b4ee848_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-10_2c637167fd0ed3630f0335150b4ee848_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
393KB

MD5
199444689c25f6fc76eb8d4f587b9a5c

SHA1
969e4ca0af1ecee21aa9089d4983591db0887c25

SHA256
9529cf09a3342f2950bb8a8f5f0881ac1b1afa58b8215567cb767c6381496227

SHA512
075ff5469e00415d8e3e973980e1f250c140d5d18be221e2cecee14f615194a6a5976007e36909d629b4480e23bbb559697ae8028877c6e2d7f02190866b9d02

Download Submit
memory/2368-18-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/2368-17-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download
memory/2376-0-0x00000000022D0000-0x00000000022D6000-memory.dmp

Filesize
24KB

Download
memory/2376-1-0x00000000022D0000-0x00000000022D6000-memory.dmp

Filesize
24KB

Download
memory/2376-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download