b7c8650bc3f5fbcbe7b1ceb4b3885b69a22aebe89f8bf266e7c362e720dc8182

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 05:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-28_bfbc36d94a99a96cef476954984055c9_cryptolocker.exe
Size

386KB
MD5

bfbc36d94a99a96cef476954984055c9
SHA1

81d995e34360e31eb234e0ea7be1efdc8c839c79
SHA256

b7c8650bc3f5fbcbe7b1ceb4b3885b69a22aebe89f8bf266e7c362e720dc8182
SHA512

d2001cbaae289cfbb4f2393ef5f40d162dbd85911ca64f6c1b877e4ae769049513b86b7fff6953eb195bf6221eb68253b9bb1b2a479a66112f4220eed0b2d485
SSDEEP

6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzXE:nnOflT/ZFIjBz3xjTxynGUOUhXE

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012248-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2080	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2864	2024-02-28_bfbc36d94a99a96cef476954984055c9_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2080	2864	2024-02-28_bfbc36d94a99a96cef476954984055c9_cryptolocker.exe	28
PID 2864 wrote to memory of 2080	2864	2024-02-28_bfbc36d94a99a96cef476954984055c9_cryptolocker.exe	28
PID 2864 wrote to memory of 2080	2864	2024-02-28_bfbc36d94a99a96cef476954984055c9_cryptolocker.exe	28
PID 2864 wrote to memory of 2080	2864	2024-02-28_bfbc36d94a99a96cef476954984055c9_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-28_bfbc36d94a99a96cef476954984055c9_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-28_bfbc36d94a99a96cef476954984055c9_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
386KB

MD5
918a1dbce2b2d525e9984198067aac6c

SHA1
641d5d4a7ea2ea93a3e860d514e484135d49b067

SHA256
b431001043e1f450e7ba8fb2da2b44a22307e93cf724248bd161a74b85da810b

SHA512
9820f6d0f08a6e0c3fb460866d820b193d61596b6d2cae5cf5a462908a583503bf19215e04c5c953ff13098df351e24552e441ef801e01c2c10b0681e8fc6583

Download Submit
memory/2080-15-0x0000000001CB0000-0x0000000001CB6000-memory.dmp

Filesize
24KB

Download
memory/2080-22-0x0000000001CA0000-0x0000000001CA6000-memory.dmp

Filesize
24KB

Download
memory/2864-0-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/2864-1-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2864-7-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download