f274b103a2c65e86996319d23a5e5901f3d4f3e31812e5d117b2cacabbd999ca

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 13:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-07-23_6056085e04cb0f947f13e76a1f82d163_cryptolocker.exe
Size

35KB
MD5

6056085e04cb0f947f13e76a1f82d163
SHA1

677c5eee281d8a7a081e4e84eae94ba182b62b68
SHA256

f274b103a2c65e86996319d23a5e5901f3d4f3e31812e5d117b2cacabbd999ca
SHA512

12f15fcf6681ee10094922a597cd7bea2d4e8d72878c43d3392df23d122a111a7e46ebd5e017e76af388d9ae3436e93080c66c7347d924c5fe7c8111c24142b3
SSDEEP

384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUGTGXvJF3SLm:bG74zYcgT/Ekd0ryfjkbCLm

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	2024-07-23_6056085e04cb0f947f13e76a1f82d163_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1816	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 512 wrote to memory of 1816	512	2024-07-23_6056085e04cb0f947f13e76a1f82d163_cryptolocker.exe	84
PID 512 wrote to memory of 1816	512	2024-07-23_6056085e04cb0f947f13e76a1f82d163_cryptolocker.exe	84
PID 512 wrote to memory of 1816	512	2024-07-23_6056085e04cb0f947f13e76a1f82d163_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-07-23_6056085e04cb0f947f13e76a1f82d163_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-23_6056085e04cb0f947f13e76a1f82d163_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:512
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
35KB

MD5
e7d512dbb6175cbe828b2fb28b4148c9

SHA1
ae3ca935bc16c8a471303b0bb4f5fc8dfab963ec

SHA256
bc322f6bae8fecb4ce0aacf4c420b42df569278e21a9b462d2d9e69611f8937c

SHA512
d3b5bbcacbe5198e3f62657ed33f0b25be908a98f94cefaa92b1b227ac3ff3eadb8be9e1e13e8abcd5bfd09f3021d94087c5a891a8cefef21d65186fd6fa9b46

Download Submit
memory/512-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/512-1-0x0000000000670000-0x0000000000676000-memory.dmp

Filesize
24KB

Download
memory/512-2-0x0000000000670000-0x0000000000676000-memory.dmp

Filesize
24KB

Download
memory/512-3-0x00000000021C0000-0x00000000021C6000-memory.dmp

Filesize
24KB

Download
memory/512-17-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/1816-19-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/1816-25-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download
memory/1816-26-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download