Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/10/2024, 02:37

General

  • Target

    2024-10-18_7e91da66fdd0d67239af9edc144f8237_cryptolocker.exe

  • Size

    35KB

  • MD5

    7e91da66fdd0d67239af9edc144f8237

  • SHA1

    8e54f314161bb24e679fc797f42b5b32d6b40354

  • SHA256

    669cebb643f0b003ad4d2c9646f7e3b7d977dec3f7e775b51f27e16b20c75ab8

  • SHA512

    779196662725de24985d20629577f924a4aae3cf88131f54d14cc14b9dcc7aa0b566869073557f18a40be986af9830501b1a4f872903d6cd9f717fbe0d971c72

  • SSDEEP

    384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUGTGXvJF3SLY:bG74zYcgT/Ekd0ryfjkbCLY

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-18_7e91da66fdd0d67239af9edc144f8237_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-18_7e91da66fdd0d67239af9edc144f8237_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3148
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3032

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    35KB

    MD5

    4f31a57e9f143d310e2baafb48acd8ff

    SHA1

    9c0385c43e49d23b27c079b17a1caaf1002fc21c

    SHA256

    a48ffc50b672f9bfa4dff5f675598a8430d814be16e169c2acb64e29dc1e4493

    SHA512

    c2413d9c59a5b4b173833361e1ffdab94c1da9adb4581beb3e7ef77ab14e4835c5e81672f1302cc1e6569c6f5bcb2d338d376316fe7121c11a91ecc54bf9dd0a

  • memory/3032-19-0x0000000003010000-0x0000000003016000-memory.dmp

    Filesize

    24KB

  • memory/3032-25-0x0000000002120000-0x0000000002126000-memory.dmp

    Filesize

    24KB

  • memory/3032-26-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/3148-0-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/3148-1-0x0000000002350000-0x0000000002356000-memory.dmp

    Filesize

    24KB

  • memory/3148-2-0x0000000002350000-0x0000000002356000-memory.dmp

    Filesize

    24KB

  • memory/3148-3-0x0000000003150000-0x0000000003156000-memory.dmp

    Filesize

    24KB

  • memory/3148-17-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB