514d71a06b5c074eb07af8e04e786c65438d1ad98adb6e63c6a442198c171a3f

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2024 08:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-31_25dca2f755b8491e8c0252bfc0c158e8_cryptolocker.exe
Size

47KB
MD5

25dca2f755b8491e8c0252bfc0c158e8
SHA1

331e39301f12f37adc7f5e7f525e6903c69e5133
SHA256

514d71a06b5c074eb07af8e04e786c65438d1ad98adb6e63c6a442198c171a3f
SHA512

b3187aab129e5524b8dfc6b5285d0ad2cddb5219a3fe652a7cd5a2f51646c7c3346d4e92f0d54dff37997782e61683eafabc1db94cbb74d47734fecd128132a0
SSDEEP

384:bm74uGLLQRcsdeQ72ngEr4K7YmE8jb0nrlwfjDUknqs+P:bm74zYcgT/EkM0ryfjdnqs8

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	2024-10-31_25dca2f755b8491e8c0252bfc0c158e8_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2304	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-31_25dca2f755b8491e8c0252bfc0c158e8_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hasfj.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 2304	1144	2024-10-31_25dca2f755b8491e8c0252bfc0c158e8_cryptolocker.exe	84
PID 1144 wrote to memory of 2304	1144	2024-10-31_25dca2f755b8491e8c0252bfc0c158e8_cryptolocker.exe	84
PID 1144 wrote to memory of 2304	1144	2024-10-31_25dca2f755b8491e8c0252bfc0c158e8_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-10-31_25dca2f755b8491e8c0252bfc0c158e8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-31_25dca2f755b8491e8c0252bfc0c158e8_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
47KB

MD5
a41479f053a770024aef5fcfcc0aef25

SHA1
68b0963767f8d0e01bbf7cf6b8ba48f5067986b4

SHA256
3ad195f5d8d25092d253e5196030424eca2dc53dac7313fd0902a7805c0001e8

SHA512
6c7d2e5fafe4607a0bd880b747d50aedd6ba52e91811f7ff237fc2671ef69f0afe18ae9a52c7f81e939676c6a879bd70bd70cbdb82f91f138257f879fadd017e

Download Submit
memory/1144-0-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/1144-1-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/1144-2-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/1144-3-0x0000000002400000-0x0000000002406000-memory.dmp

Filesize
24KB

Download
memory/1144-17-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/2304-19-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/2304-25-0x0000000002120000-0x0000000002126000-memory.dmp

Filesize
24KB

Download
memory/2304-26-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download