09d70a2bc6254b8e9c2bf00057b27b83ddc3866069e00ff5f5fda9f0155e0cd2

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 06:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-05_450dbee08dd789dd6159727d6761318d_cryptolocker.exe
Size

46KB
MD5

450dbee08dd789dd6159727d6761318d
SHA1

c31f983c9ca190e5e1f131f3e28adc1d9b75cc28
SHA256

09d70a2bc6254b8e9c2bf00057b27b83ddc3866069e00ff5f5fda9f0155e0cd2
SHA512

c2a285cf51b3a88768fbe6e0286ba22b4c05a4dd1ad0d6a80f5057da03ccf757da813a5fbfb68f6f642bee47045afce2540751117cff579d5fc4edca8d058dc5
SSDEEP

384:bm74uGLLQRcsdeQ72ngEr4K7YmE8jb0nrlwfjDUknqs+ri:bm74zYcgT/EkM0ryfjdnqsZ

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	2024-10-05_450dbee08dd789dd6159727d6761318d_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1960	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-05_450dbee08dd789dd6159727d6761318d_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hasfj.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 1960	4000	2024-10-05_450dbee08dd789dd6159727d6761318d_cryptolocker.exe	82
PID 4000 wrote to memory of 1960	4000	2024-10-05_450dbee08dd789dd6159727d6761318d_cryptolocker.exe	82
PID 4000 wrote to memory of 1960	4000	2024-10-05_450dbee08dd789dd6159727d6761318d_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-10-05_450dbee08dd789dd6159727d6761318d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-05_450dbee08dd789dd6159727d6761318d_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
47KB

MD5
d600f2e35cbeb82c42728ea4c22049a1

SHA1
7defdcb8de3a2950d14fc3c22d597b21325d9f53

SHA256
a8b22cbe15a1f1b2afa0f38c88cb033b64e69c46144ccf1901959fc94bea8887

SHA512
661a150bfe2114d9515bc4d3b9500c5fc9433dd2ab8d9d872311ba22e394af613844f80374aad76ca1d0b4f65250d7ae9142f30df32c09148250031e30f8b198

Download Submit
memory/1960-25-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download
memory/1960-19-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/1960-26-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/4000-0-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/4000-1-0x00000000022D0000-0x00000000022D6000-memory.dmp

Filesize
24KB

Download
memory/4000-2-0x00000000022D0000-0x00000000022D6000-memory.dmp

Filesize
24KB

Download
memory/4000-3-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/4000-17-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download