72ce1721be5f3b051f86275ef35865ca0f5a0087dbdfb94f795311fdb04eb8c9

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 02:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-02_29ecd8a9d9476bf151cdf932adc5a351_cryptolocker.exe
Size

36KB
MD5

29ecd8a9d9476bf151cdf932adc5a351
SHA1

6392ed889695d8b55f2a2454609c2d13026c862a
SHA256

72ce1721be5f3b051f86275ef35865ca0f5a0087dbdfb94f795311fdb04eb8c9
SHA512

44dad69afefdccbbb307e83d4df7eee558851f74dfc466c2b4e3d6d19cabf9820f56c32b0eb139cbc1304157ca792afe8f4630260a444b26b92705f71d3bd385
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf0w3sp8u5cZs+:bgX4zYcgTEu6QOaryfjqDDw3sCu5k

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000122c9-13.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
1200	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2108	2024-02-02_29ecd8a9d9476bf151cdf932adc5a351_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 1200	2108	2024-02-02_29ecd8a9d9476bf151cdf932adc5a351_cryptolocker.exe	28
PID 2108 wrote to memory of 1200	2108	2024-02-02_29ecd8a9d9476bf151cdf932adc5a351_cryptolocker.exe	28
PID 2108 wrote to memory of 1200	2108	2024-02-02_29ecd8a9d9476bf151cdf932adc5a351_cryptolocker.exe	28
PID 2108 wrote to memory of 1200	2108	2024-02-02_29ecd8a9d9476bf151cdf932adc5a351_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-02_29ecd8a9d9476bf151cdf932adc5a351_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-02_29ecd8a9d9476bf151cdf932adc5a351_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
36KB

MD5
b9569420dd4c23d23047a32eaad013ba

SHA1
60e1d535087933252c5d901268757cb81d6a7163

SHA256
6e9217b09e224a8de6e267197650c6d9b9019c05bcab626d725c53f190b4bc36

SHA512
80e88dbac4c5d7023f10f4958d0ff00f0af101dcc5ba791ead440f43e383a337fcc8e7609e810503b82f7d4e5e01a25449e08c54116870a88592d2b90732c366

Download Submit
memory/1200-15-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1200-22-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2108-0-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/2108-1-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/2108-8-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download