dec85dd1a7a027b54600fdd8876af74ac18e34c21028b59c3999ec2b1ae361e3

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-11_0d5dee2553fc88e3eef8e7876692b654_cryptolocker.exe
Size

392KB
MD5

0d5dee2553fc88e3eef8e7876692b654
SHA1

630b86f0bcc2a58c53d8058d190001e5a3a413b4
SHA256

dec85dd1a7a027b54600fdd8876af74ac18e34c21028b59c3999ec2b1ae361e3
SHA512

95c187cf5b2f0029fc4ee9cdfe44ec4a97aa2c695db2663f90fca4b9dc58d7071bf42f6484f3c1cf37de781cba484637fef5797ae39edc0ee2c9d0497058c778
SSDEEP

6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzXRK:nnOflT/ZFIjBz3xjTxynGUOUhXRK

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	2024-08-11_0d5dee2553fc88e3eef8e7876692b654_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3624	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-11_0d5dee2553fc88e3eef8e7876692b654_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hasfj.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 3624	2740	2024-08-11_0d5dee2553fc88e3eef8e7876692b654_cryptolocker.exe	86
PID 2740 wrote to memory of 3624	2740	2024-08-11_0d5dee2553fc88e3eef8e7876692b654_cryptolocker.exe	86
PID 2740 wrote to memory of 3624	2740	2024-08-11_0d5dee2553fc88e3eef8e7876692b654_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-08-11_0d5dee2553fc88e3eef8e7876692b654_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-11_0d5dee2553fc88e3eef8e7876692b654_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
392KB

MD5
96d84d93bbf3e85d8643157fa59e2c29

SHA1
ebf064a543536d1a1c6915bc7278b642250a45d8

SHA256
5742993b8f15aeabdb503d3e97e7a94449d19acd2747d780bc2df179c118f13e

SHA512
93815564d5c323d64b2cb3a25e78da60bf6a5c5082580b7f03fdbf18d92fd1fdd102888d87d23f76dca41b53dc30821ca53bb449639befad6578a503d01570b6

Download Submit
memory/2740-0-0x0000000002340000-0x0000000002346000-memory.dmp

Filesize
24KB

Download
memory/2740-1-0x0000000002340000-0x0000000002346000-memory.dmp

Filesize
24KB

Download
memory/2740-2-0x00000000023F0000-0x00000000023F6000-memory.dmp

Filesize
24KB

Download
memory/3624-17-0x0000000003140000-0x0000000003146000-memory.dmp

Filesize
24KB

Download
memory/3624-23-0x0000000002E90000-0x0000000002E96000-memory.dmp

Filesize
24KB

Download