59cb7eb2f2d68a5ec665671969c3315a0af8cabee4032ceccf0db5e28e4782c6

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23/01/2024, 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-23_fb9a211fba7bc7364a5e0ccd24fcb7eb_cryptolocker.exe
Size

45KB
MD5

fb9a211fba7bc7364a5e0ccd24fcb7eb
SHA1

2b7541a8b032fd38453bf36c898cf28642cbe4ba
SHA256

59cb7eb2f2d68a5ec665671969c3315a0af8cabee4032ceccf0db5e28e4782c6
SHA512

42aa7c2c11ef32a0941873561d0e5b3fd1562e1a2b104b3e88c22a3027a5690b898ca0f441fe555d4d42d6f211dedf7c10ab79c4b7e6f97e19e4b384172cd47d
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37Yl6dE+:bgGYcA/53GAA6y37Q6dJ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012243-21.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2080	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2212	2024-01-23_fb9a211fba7bc7364a5e0ccd24fcb7eb_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2080	2212	2024-01-23_fb9a211fba7bc7364a5e0ccd24fcb7eb_cryptolocker.exe	17
PID 2212 wrote to memory of 2080	2212	2024-01-23_fb9a211fba7bc7364a5e0ccd24fcb7eb_cryptolocker.exe	17
PID 2212 wrote to memory of 2080	2212	2024-01-23_fb9a211fba7bc7364a5e0ccd24fcb7eb_cryptolocker.exe	17
PID 2212 wrote to memory of 2080	2212	2024-01-23_fb9a211fba7bc7364a5e0ccd24fcb7eb_cryptolocker.exe	17

C:\Users\Admin\AppData\Local\Temp\2024-01-23_fb9a211fba7bc7364a5e0ccd24fcb7eb_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-23_fb9a211fba7bc7364a5e0ccd24fcb7eb_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
45KB

MD5
03745c809ab351edbc3b4e1eecd8058a

SHA1
2751648d38f6d0cde40067d3c92cc2b8c8c16742

SHA256
c3bdc54324f8897713b416e1cdf74caac7f6eeac2a3e26bab977f5b39c6368ac

SHA512
f3ad1f0790da588655cb0ce4b9c5e7ac49a23b72b222a0f8ff6252a1744f4d3d08178d66406f0ba3b5428c01bc583d31e757173891645d4faed026a2a4c87d5f

Download Submit
memory/2080-22-0x0000000001C80000-0x0000000001C86000-memory.dmp

Filesize
24KB

Download
memory/2080-15-0x0000000001CE0000-0x0000000001CE6000-memory.dmp

Filesize
24KB

Download
memory/2212-0-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2212-2-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2212-1-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download