3b26ef0b149a25358381ed8ef34431478e8a81951328d8b06092bd63bbd84ea1

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-01-2024 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-24_9eda9e1c17c67b0d3c79231f3475a95d_cryptolocker.exe
Size

33KB
MD5

9eda9e1c17c67b0d3c79231f3475a95d
SHA1

e3980f3fc010c42e4d87853ee1fd456b92d81478
SHA256

3b26ef0b149a25358381ed8ef34431478e8a81951328d8b06092bd63bbd84ea1
SHA512

d945e73e46c05b80f33b0fce5479a6330e7a7ebd8a7065db77de5a045061778795656dc92af4524c86253d173d20b332a918df36853c8e7eb7456d321a4944b9
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUqMV6U8zKvGaL0:bA74zYcgT/Ekd0ryfj86U8zbZ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012252-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2324	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2400	2024-01-24_9eda9e1c17c67b0d3c79231f3475a95d_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2324	2400	2024-01-24_9eda9e1c17c67b0d3c79231f3475a95d_cryptolocker.exe	28
PID 2400 wrote to memory of 2324	2400	2024-01-24_9eda9e1c17c67b0d3c79231f3475a95d_cryptolocker.exe	28
PID 2400 wrote to memory of 2324	2400	2024-01-24_9eda9e1c17c67b0d3c79231f3475a95d_cryptolocker.exe	28
PID 2400 wrote to memory of 2324	2400	2024-01-24_9eda9e1c17c67b0d3c79231f3475a95d_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-24_9eda9e1c17c67b0d3c79231f3475a95d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-24_9eda9e1c17c67b0d3c79231f3475a95d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
33KB

MD5
892b0a6008a8795394133267da47abec

SHA1
fc021cc9736f773eef347553ce7637ade770bbbe

SHA256
6aae77c53ebbf421323002a4f17a49f14a9bc7674f0cff30a6c7156c83a004cb

SHA512
a32b227e617bfbc9ca1bbba366e2bbde66393611a7132c0e4f97c7c05beadc7caf98f0a005e73fb38b2965b05237781dc3ee880d042efadcdc74074a33c270a4

Download Submit
memory/2324-17-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2400-0-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2400-2-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2400-1-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download