ee204d8d1254f93c8b1e5251497ae3d53f7aa30268b92f16315501129e874466

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 05:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-10-09_f4c0bae86b4b1022a527374a2b581631_cryptolocker.exe
Size

41KB
MD5

f4c0bae86b4b1022a527374a2b581631
SHA1

6ebb3d786f64cc699606d5215031404784b248af
SHA256

ee204d8d1254f93c8b1e5251497ae3d53f7aa30268b92f16315501129e874466
SHA512

5209d210700061bebb2d4213ee1eed6818db78e88fd8e1f2cc468f6927fe782db8674d3dc6c07b1a0f2e77686f1db4ee2a378f222ee7513e9e74b9a8c3f8a0fe
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf6XT+72kmGYjlQxIxI37:bgX4zYcgTEu6QOaryfjqDlC7rYZQKM7

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	2024-10-09_f4c0bae86b4b1022a527374a2b581631_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2196	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-09_f4c0bae86b4b1022a527374a2b581631_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hasfj.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 2196	820	2024-10-09_f4c0bae86b4b1022a527374a2b581631_cryptolocker.exe	86
PID 820 wrote to memory of 2196	820	2024-10-09_f4c0bae86b4b1022a527374a2b581631_cryptolocker.exe	86
PID 820 wrote to memory of 2196	820	2024-10-09_f4c0bae86b4b1022a527374a2b581631_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-10-09_f4c0bae86b4b1022a527374a2b581631_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-09_f4c0bae86b4b1022a527374a2b581631_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:820
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
41KB

MD5
7275c03eefcf7178043167e44d85b821

SHA1
919535fb58a992ff6ae1ac0dcd7bc9fdcb27bbac

SHA256
ed6d50ff8673219807fe02054767b05cb9498a1f9ee145892f326b8e3572b02e

SHA512
9ce0ba10fe7fad8b2d443a33d58609e8c76e8f9500177fc7560e5a4b9bdc673e8a374a4155dc5b843bc60fbdbe5224c657b1ed585ec914b2963ad61e54cda941

Download Submit
memory/820-0-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/820-1-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/820-2-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/2196-17-0x0000000002590000-0x0000000002596000-memory.dmp

Filesize
24KB

Download
memory/2196-23-0x0000000002560000-0x0000000002566000-memory.dmp

Filesize
24KB

Download