Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25-01-2024 17:36

General

  • Target

    2024-01-25_b837865ab3bd08266b105a4fe1797dc0_cryptolocker.exe

  • Size

    46KB

  • MD5

    b837865ab3bd08266b105a4fe1797dc0

  • SHA1

    05f277a0a13a2d75fe7bd3e28e7a824bf4112162

  • SHA256

    ade65af2774459a828865f24c74ee6f922cdaaa01d0d7b23d5c5eed6ee0359c4

  • SHA512

    89a50a55df4fcf1266559edf06a093e13a8ed3f750de662e2f4e2a5ffe3911405378207802485d1f7c8010a0d1ee61b495dcd52e9d74f4850b42776cb7c68c9e

  • SSDEEP

    768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37YbDu5z/hDa:bgGYcA/53GAA6y37nbG

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-25_b837865ab3bd08266b105a4fe1797dc0_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-25_b837865ab3bd08266b105a4fe1797dc0_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:2336

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\hasfj.exe
    Filesize

    46KB

    MD5

    df286ca42d8ecfceb8cb858e4831730c

    SHA1

    195946f6528e996017cb4e9018258a1bc5d942a9

    SHA256

    fc2565736f1bdb62924243227c43471e57117e71ed7aed3e539fcc31fd8b8de3

    SHA512

    386fdca9c37b77cdbff1443bd539814bee23777518786527bb5ad6728f61ff9d647b45191ac12a5ab24d2aeb50642d938f59048592cf5844f0f755d4c10d35b7

  • memory/2336-15-0x0000000000290000-0x0000000000296000-memory.dmp
    Filesize

    24KB

  • memory/2336-19-0x0000000000270000-0x0000000000276000-memory.dmp
    Filesize

    24KB

  • memory/2408-0-0x00000000005F0000-0x00000000005F6000-memory.dmp
    Filesize

    24KB

  • memory/2408-1-0x0000000001CA0000-0x0000000001CA6000-memory.dmp
    Filesize

    24KB

  • memory/2408-8-0x00000000005F0000-0x00000000005F6000-memory.dmp
    Filesize

    24KB