2edf794a44c3d5538ea5e90f5a57e98e5382aa31663f300cd97b57572e395a77

Analysis

max time kernel
114s
max time network
158s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23-01-2024 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-23_3fb587284baf557e6276f27ec9901bfd_cryptolocker.exe
Size

40KB
MD5

3fb587284baf557e6276f27ec9901bfd
SHA1

1271c73bc46ecd7e9a23cd6511736a95b85a2369
SHA256

2edf794a44c3d5538ea5e90f5a57e98e5382aa31663f300cd97b57572e395a77
SHA512

12ef6f82f9d9406329d7bbf5fc6c70d0239ef7d879f1734be19e3ed1932b4047967b1c87db0d56e9e058c9730d6776dc8cafbf0d37a0f86fc0eff4129f55f1ce
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf0w3sp8u5co9+slz:bgX4zYcgTEu6QOaryfjqDDw3sCu5b+s5

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012280-13.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2280	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2152	2024-01-23_3fb587284baf557e6276f27ec9901bfd_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2280	2152	2024-01-23_3fb587284baf557e6276f27ec9901bfd_cryptolocker.exe	28
PID 2152 wrote to memory of 2280	2152	2024-01-23_3fb587284baf557e6276f27ec9901bfd_cryptolocker.exe	28
PID 2152 wrote to memory of 2280	2152	2024-01-23_3fb587284baf557e6276f27ec9901bfd_cryptolocker.exe	28
PID 2152 wrote to memory of 2280	2152	2024-01-23_3fb587284baf557e6276f27ec9901bfd_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-23_3fb587284baf557e6276f27ec9901bfd_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-23_3fb587284baf557e6276f27ec9901bfd_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
40KB

MD5
6e91e72ec2b515e536265d1f1d9b53c6

SHA1
4fca0bce9e85efe3e8c2a7e44ab065e07d5e5173

SHA256
54c86173c1c45aca7cc7f06fbece45a709eac4ca8012be1d519028b00997fe25

SHA512
80e3a8559521b908a14d5787d036cb3ccf92515725f70ca6e44708449a972563313a389a251e6caa951ef8c73c5526d1bb7ef8f71f71311ab874bdd120c57ebf

Download Submit
memory/2152-0-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2152-1-0x0000000001B40000-0x0000000001B46000-memory.dmp

Filesize
24KB

Download
memory/2152-2-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2280-22-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2280-15-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download