2da0954fa2c90e10f56c0c644815aadc932466334d1523c5c3cd247afd7012f8

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2024 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-14_b5c37c2e4b3e7ebe73c29bcd99a7f8d3_cryptolocker.exe
Size

46KB
MD5

b5c37c2e4b3e7ebe73c29bcd99a7f8d3
SHA1

61a9e4e12ca8bded83d3b28ae8f61c815597da67
SHA256

2da0954fa2c90e10f56c0c644815aadc932466334d1523c5c3cd247afd7012f8
SHA512

1b54e0d002a06b3798ceaa7b48d23ec5753c6182f9dd9554b049d151a6c701d216219425a3c5cf939eaf0cb9226c5c660b6666d53f5852f94e7fee5d809170fa
SSDEEP

384:bm74uGLLQRcsdeQ72ngEr4K7YmE8jb0nrlwfjDUadQC8JT:bm74zYcgT/EkM0ryfjPdQZJT

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	2024-10-14_b5c37c2e4b3e7ebe73c29bcd99a7f8d3_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
772	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-14_b5c37c2e4b3e7ebe73c29bcd99a7f8d3_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hasfj.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 772	3448	2024-10-14_b5c37c2e4b3e7ebe73c29bcd99a7f8d3_cryptolocker.exe	85
PID 3448 wrote to memory of 772	3448	2024-10-14_b5c37c2e4b3e7ebe73c29bcd99a7f8d3_cryptolocker.exe	85
PID 3448 wrote to memory of 772	3448	2024-10-14_b5c37c2e4b3e7ebe73c29bcd99a7f8d3_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-10-14_b5c37c2e4b3e7ebe73c29bcd99a7f8d3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-14_b5c37c2e4b3e7ebe73c29bcd99a7f8d3_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
46KB

MD5
df0a5edbed41f1e95cc1c7510a6bdbda

SHA1
b357fe4990d381c3fb1d0017906f60be938aafe1

SHA256
c0fd179d16257e1523d5d8d0416844d0911f899dcb260fbbc650ab41ada7d795

SHA512
14560857cc6862aadd02cda1087e7fb6182ecfeca1782bf92a36a3242f1293b3aeac048e64effb8d27883df9d6ab5d5d4aab85a4788dff993c2e7846947cf168

Download Submit
memory/772-19-0x00000000022C0000-0x00000000022C6000-memory.dmp

Filesize
24KB

Download
memory/772-25-0x0000000002110000-0x0000000002116000-memory.dmp

Filesize
24KB

Download
memory/772-26-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/3448-0-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/3448-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/3448-2-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/3448-3-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download
memory/3448-17-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download