Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    19-02-2024 17:26

General

  • Target

    2024-02-19_2143481eab83e07a291850099fe1c104_cryptolocker.exe

  • Size

    34KB

  • MD5

    2143481eab83e07a291850099fe1c104

  • SHA1

    9db5987590aa9987c92c17697f4f7c8103849dd1

  • SHA256

    51a4341ce43d90df56468a4a2764fab298f5256312ffee16e80867528f335fd3

  • SHA512

    3080002bba98e59ebda6a74fe0e1b0ae28640fe9f7aede84228503dca70c39afe1f9c301d52bb2a3a782ce2b34b2cc7364dc4eaca49c4f33790f34d8007b1bcb

  • SSDEEP

    384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUqMV6U8zKvGaLigYdO:bA74zYcgT/Ekd0ryfj86U8zbUYdO

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-19_2143481eab83e07a291850099fe1c104_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-19_2143481eab83e07a291850099fe1c104_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:776
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:1968

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    34KB

    MD5

    d072812228e71236e81e2a44193f5902

    SHA1

    b4d7f1639f3833e0aba89ae0120d781440e6d9f3

    SHA256

    2d1a7d8ac358ecdbd3bdd85650421848ef5d59ca3dcf37ee65381a98e97f8742

    SHA512

    45dc7d6564f34e7dc9bba0589561172de1468d7a2f7dc135dec514aaabd781791a393f6665286b72d0bc9061d903082ece34193135edeb140ed8da5a906a2766

  • memory/776-0-0x0000000000700000-0x0000000000706000-memory.dmp

    Filesize

    24KB

  • memory/776-2-0x0000000000700000-0x0000000000706000-memory.dmp

    Filesize

    24KB

  • memory/776-1-0x0000000001CB0000-0x0000000001CB6000-memory.dmp

    Filesize

    24KB

  • memory/1968-16-0x0000000001BD0000-0x0000000001BD6000-memory.dmp

    Filesize

    24KB

  • memory/1968-15-0x0000000001BC0000-0x0000000001BC6000-memory.dmp

    Filesize

    24KB