38b792be7521665547e9fb933fee5a9ebbd8e2663bcb46575594e2bff31e82a4

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_214afdbac15a26a76b2786a474ef50d3_cryptolocker.exe
Size

30KB
MD5

214afdbac15a26a76b2786a474ef50d3
SHA1

a653d64ae39002d2f8e76e45b19a977c46b65beb
SHA256

38b792be7521665547e9fb933fee5a9ebbd8e2663bcb46575594e2bff31e82a4
SHA512

3dfc932de4707376df1f84ce177b4ab95c4c9d170a0ac42a469a66b7d1592a657978190bea83912b55b780acca962d9c35ec77fe8c210cc1e13cc30ac37e3949
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUgIunvsa:bA74zYcgT/Ekd0ryfjPIunvsa

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a00000001224c-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2116	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
3032	2024-01-25_214afdbac15a26a76b2786a474ef50d3_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2116	3032	2024-01-25_214afdbac15a26a76b2786a474ef50d3_cryptolocker.exe	28
PID 3032 wrote to memory of 2116	3032	2024-01-25_214afdbac15a26a76b2786a474ef50d3_cryptolocker.exe	28
PID 3032 wrote to memory of 2116	3032	2024-01-25_214afdbac15a26a76b2786a474ef50d3_cryptolocker.exe	28
PID 3032 wrote to memory of 2116	3032	2024-01-25_214afdbac15a26a76b2786a474ef50d3_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-25_214afdbac15a26a76b2786a474ef50d3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_214afdbac15a26a76b2786a474ef50d3_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
30KB

MD5
d10e2055f261e6e1bdb64acfd352a00b

SHA1
ff53e7e8cee1ec53d465ed7deee3e74888d75258

SHA256
deedf5f253fd90d5770bb3929bdc964e4fc576b7bccec9a04721d65188efbf00

SHA512
a06c62104bb07c016a6b74d3031e91da0b3e660d7125dad25f270fab32788ab23416c95f6c55529e2a13cc743e8cde462fb88bb9ac75ac2dab5bdb46b3046c34

Download Submit
memory/2116-15-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/2116-22-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/3032-0-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/3032-1-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/3032-8-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download