86d654c9f8144422729a55226e96c531472d55e0f8ba430a9940a3b094941744

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 10:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-23_37ab6e95c530f7fa086e2933135b5ae4_cryptolocker.exe
Size

385KB
MD5

37ab6e95c530f7fa086e2933135b5ae4
SHA1

4ae9ca5b55aed00c8e8d8b55c86da6b194d9b31a
SHA256

86d654c9f8144422729a55226e96c531472d55e0f8ba430a9940a3b094941744
SHA512

8f3040738152b43ba3849683e9d59da36d0725a3aa1115a253250bf5096c9b8e9a602f2a2265279559f3acaf4db0aefd51edb03cc6f228506bc173ed5d789ae6
SSDEEP

6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzXd:nnOflT/ZFIjBz3xjTxynGUOUhXd

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001223a-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
1408	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2184	2024-02-23_37ab6e95c530f7fa086e2933135b5ae4_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1408	2184	2024-02-23_37ab6e95c530f7fa086e2933135b5ae4_cryptolocker.exe	28
PID 2184 wrote to memory of 1408	2184	2024-02-23_37ab6e95c530f7fa086e2933135b5ae4_cryptolocker.exe	28
PID 2184 wrote to memory of 1408	2184	2024-02-23_37ab6e95c530f7fa086e2933135b5ae4_cryptolocker.exe	28
PID 2184 wrote to memory of 1408	2184	2024-02-23_37ab6e95c530f7fa086e2933135b5ae4_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-23_37ab6e95c530f7fa086e2933135b5ae4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-23_37ab6e95c530f7fa086e2933135b5ae4_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
386KB

MD5
ff890e6faca29dea39d941add472d148

SHA1
d1f0d9cd4a1a78e769ca1904ca60293b4ff3ef2e

SHA256
194b7f0111d5abd2aab3f058948415f852e7c76305401ebe71487b3fbb6f2093

SHA512
6cec65c8495230dcf07da6bf7f20fae1a111e0f4d1b92994a68df3a40e2e1dc9819472f6e987ff57bd8878f5d94b34b5e7ec3af2b5b0fc3b8c8d6c960e8cb079

Download Submit
memory/1408-16-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/1408-15-0x0000000002920000-0x0000000002926000-memory.dmp

Filesize
24KB

Download
memory/2184-0-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/2184-2-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/2184-1-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download