d10fedf908f6cb992dd9d50c22b2b335be4caa50215796b8aa65c3f321d3de57

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 19:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-21_0872c8134848d3cd471c591cf2161a49_cryptolocker.exe
Size

46KB
MD5

0872c8134848d3cd471c591cf2161a49
SHA1

7102d120a647a81784335bd2ca6d480538ce14c8
SHA256

d10fedf908f6cb992dd9d50c22b2b335be4caa50215796b8aa65c3f321d3de57
SHA512

405dc8fc5f13d0163f866a84da999f1f0db9242dc2b30e2876da4ae96aa70b0f7b30a5fc3075219e1f16fdb451e1fd1cc68aff64069548803481127e111baef9
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37Yl6ElwC:bgGYcA/53GAA6y37Q68wC

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012272-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
3016	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2784	2024-02-21_0872c8134848d3cd471c591cf2161a49_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 3016	2784	2024-02-21_0872c8134848d3cd471c591cf2161a49_cryptolocker.exe	28
PID 2784 wrote to memory of 3016	2784	2024-02-21_0872c8134848d3cd471c591cf2161a49_cryptolocker.exe	28
PID 2784 wrote to memory of 3016	2784	2024-02-21_0872c8134848d3cd471c591cf2161a49_cryptolocker.exe	28
PID 2784 wrote to memory of 3016	2784	2024-02-21_0872c8134848d3cd471c591cf2161a49_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-21_0872c8134848d3cd471c591cf2161a49_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-21_0872c8134848d3cd471c591cf2161a49_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
46KB

MD5
9a7b05f514c2d66cdaf199d8b4e7190b

SHA1
ed19bedeee70325bee884ae54fd8f370ddb176ce

SHA256
2f85620c785dd4903069c05e2cb5338b604b402bfd78df381214cfc728543394

SHA512
2f41d1418fc72d241acda0a7d43d1207a5ce96e02485511801ade5d20f3c7a0a22c64306c3e705d493410b32d1f8340fb0c03510fab2e6d382ce3bb0a326a496

Download Submit
memory/2784-0-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2784-2-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2784-1-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/3016-15-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/3016-16-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download