Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12-02-2024 20:00
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-12_5b1d2071ecec8973156b5f67fff633e5_cryptolocker.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-12_5b1d2071ecec8973156b5f67fff633e5_cryptolocker.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-12_5b1d2071ecec8973156b5f67fff633e5_cryptolocker.exe
-
Size
384KB
-
MD5
5b1d2071ecec8973156b5f67fff633e5
-
SHA1
f06fb6677e1bb483c9ca576d47e542027e64189d
-
SHA256
42d1894422e89868bfead8b67fee3f445b424b366029402a4960dcd4310ff333
-
SHA512
2993b4f6659c573b6b2dbf1f8ef7bb394b4f4c72050c33c46f2eac1aff23491bf666e67ea3e68313f838feff337665815ea661b7b7f96e04ef72bf82c3d4d729
-
SSDEEP
6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzXQ:nnOflT/ZFIjBz3xjTxynGUOUhXQ
Malware Config
Signatures
-
Detection of CryptoLocker Variants 2 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\hasfj.exe CryptoLocker_rule2 C:\Users\Admin\AppData\Local\Temp\hasfj.exe CryptoLocker_rule2 -
Executes dropped EXE 1 IoCs
Processes:
hasfj.exepid process 2864 hasfj.exe -
Loads dropped DLL 1 IoCs
Processes:
2024-02-12_5b1d2071ecec8973156b5f67fff633e5_cryptolocker.exepid process 2076 2024-02-12_5b1d2071ecec8973156b5f67fff633e5_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-02-12_5b1d2071ecec8973156b5f67fff633e5_cryptolocker.exedescription pid process target process PID 2076 wrote to memory of 2864 2076 2024-02-12_5b1d2071ecec8973156b5f67fff633e5_cryptolocker.exe hasfj.exe PID 2076 wrote to memory of 2864 2076 2024-02-12_5b1d2071ecec8973156b5f67fff633e5_cryptolocker.exe hasfj.exe PID 2076 wrote to memory of 2864 2076 2024-02-12_5b1d2071ecec8973156b5f67fff633e5_cryptolocker.exe hasfj.exe PID 2076 wrote to memory of 2864 2076 2024-02-12_5b1d2071ecec8973156b5f67fff633e5_cryptolocker.exe hasfj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_5b1d2071ecec8973156b5f67fff633e5_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_5b1d2071ecec8973156b5f67fff633e5_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\hasfj.exeFilesize
192KB
MD52fd1286850e6616eb12abdfd28d51202
SHA1c7c12af68ffae39f89f3ed7a4df1e981781c98ac
SHA256729bb955f942ea7cfd99369b4738991fbc8c82fe493de2c7ed66a7ee023b5dbe
SHA512d13f7a9b93154b2e57db1aa86a9fa8343a05b0a658c1b129db1abdde8cf5856fa20440d488fb517c62ad3a8d63853678f01249dc7fac76621321dae1b0f237a9
-
\Users\Admin\AppData\Local\Temp\hasfj.exeFilesize
385KB
MD59dd0cda8ef64ce3efc2019fbb29e3bd3
SHA149d688140bef44be69578b97dc35b57d56dc7027
SHA256dbc7e9ad31e352bb11ca7fcf1e023725322770ae4fd38ddab7f0b8bc520e9697
SHA5125781e2d3d18e63c850b9e7cb8d4cbc22338e27fe7aeac15d5cc58a7afc64230ff1c424be7ae0ff6bd074b959f4fbf942ab33e460747fd84e7ef48447c6c14fd4
-
memory/2076-0-0x00000000002D0000-0x00000000002D6000-memory.dmpFilesize
24KB
-
memory/2076-1-0x00000000002E0000-0x00000000002E6000-memory.dmpFilesize
24KB
-
memory/2076-7-0x00000000002D0000-0x00000000002D6000-memory.dmpFilesize
24KB
-
memory/2864-15-0x0000000000630000-0x0000000000636000-memory.dmpFilesize
24KB
-
memory/2864-22-0x0000000000390000-0x0000000000396000-memory.dmpFilesize
24KB