Analysis

  • max time kernel
    148s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    19-02-2024 20:29

General

  • Target

    2024-02-19_3bbabf942d024ceafb7e928294aaedb1_cryptolocker.exe

  • Size

    31KB

  • MD5

    3bbabf942d024ceafb7e928294aaedb1

  • SHA1

    eab91e4461a95b4e23259118902204da045f11bf

  • SHA256

    4b5b3c310b1a7ab788699a8761d01f40c5720cb32b7ddb005724767d6cedf4b2

  • SHA512

    a7be4d3775b6100be9986362ed5c1ea9e44f7d287270741491583f0f2c2ab1d99e9d2c01b16dc66e79324b962ea5ce1b493db28566ee91a1eacd04d294b0f5fa

  • SSDEEP

    384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUr766SJ/Tl+bltoGAz3:bA74zYcgT/Ekd0ryfjQRSlwltcz3

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-19_3bbabf942d024ceafb7e928294aaedb1_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-19_3bbabf942d024ceafb7e928294aaedb1_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2400
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:2696

Network

  • flag-us
    DNS
    mytarta.com
    hasfj.exe
    Remote address:
    8.8.8.8:53
    Request
    mytarta.com
    IN A
    Response
No results found
  • 8.8.8.8:53
    mytarta.com
    dns
    hasfj.exe
    57 B
    107 B
    1
    1

    DNS Request

    mytarta.com

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    31KB

    MD5

    0d89f111525dbb513c0af1189129ae78

    SHA1

    591f90af2cddc71672519267099d906dd933bfb4

    SHA256

    c5c3249d6dd56c82cdb9aa1c1da28218f8607791a45185d3ebc5239e5b88b2f8

    SHA512

    8e4ffc3ebb256c8cb32913c7b8b85fd76a0eabfa7b2da7623e7ee44306b367ea4f39da4d203a288fa7df59619faed1312679dcdac7324148dc9f74b1f41cc681

  • memory/2400-0-0x00000000004A0000-0x00000000004A6000-memory.dmp

    Filesize

    24KB

  • memory/2400-2-0x00000000004A0000-0x00000000004A6000-memory.dmp

    Filesize

    24KB

  • memory/2400-1-0x00000000004C0000-0x00000000004C6000-memory.dmp

    Filesize

    24KB

  • memory/2696-15-0x00000000004B0000-0x00000000004B6000-memory.dmp

    Filesize

    24KB

  • memory/2696-18-0x0000000000490000-0x0000000000496000-memory.dmp

    Filesize

    24KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.