ea8658901798d11d8e996cc623d226fe36de644d4803613426adecdca3fa9c59

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-22_e691c661e26e01269fc74b12d4548ef4_cryptolocker.exe
Size

4.5MB
MD5

e691c661e26e01269fc74b12d4548ef4
SHA1

8acad3cabd96d7740603b3d7e54aed689f6cb809
SHA256

ea8658901798d11d8e996cc623d226fe36de644d4803613426adecdca3fa9c59
SHA512

68952b7d062a69ba3150868e9f7f41f5c2490ca4ad0ee202a72aa1db27942666bb105c1cfac38021ee15be7e7256d1495c640920be464820fa3c7f13e2a8d005
SSDEEP

98304:g/ZFIjBzldUfs/ZFIjBz7jSZD1tU7ymT9:g/ZFIjBzF/ZFIjBzPEUus9

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001224f-10.dat	CryptoLocker_rule2

Detects executables built or packed with MPress PE compressor 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001224f-10.dat	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

pid	Process
2984	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
1964	2024-02-22_e691c661e26e01269fc74b12d4548ef4_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2984	1964	2024-02-22_e691c661e26e01269fc74b12d4548ef4_cryptolocker.exe	28
PID 1964 wrote to memory of 2984	1964	2024-02-22_e691c661e26e01269fc74b12d4548ef4_cryptolocker.exe	28
PID 1964 wrote to memory of 2984	1964	2024-02-22_e691c661e26e01269fc74b12d4548ef4_cryptolocker.exe	28
PID 1964 wrote to memory of 2984	1964	2024-02-22_e691c661e26e01269fc74b12d4548ef4_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-22_e691c661e26e01269fc74b12d4548ef4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-22_e691c661e26e01269fc74b12d4548ef4_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
4.5MB

MD5
0e023f36b9e6700407c159854025dfba

SHA1
af2016fa10ce30234e771f14f5a3568ff1e15e7c

SHA256
16836c687c775dd912700404cc3fb5959842ff2e61e3a62a58b52043a6693418

SHA512
147600689d37e0dfdee3a95cab20cf59fa061bf0823986b2e13efcadd492d0b73ddd058fba912b851c28a9de811f6c0bbf9ff22f556826618d0d8673f9acc008

Download Submit
memory/1964-0-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/1964-1-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/1964-7-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2984-15-0x00000000003B0000-0x00000000003B6000-memory.dmp

Filesize
24KB

Download
memory/2984-22-0x00000000003A0000-0x00000000003A6000-memory.dmp

Filesize
24KB

Download