8ed74937eef7bdf98f725b64ac9811427d67c4387d6f5604e0367303c49aa642

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 05:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-12_834d5ea0cde765981364d059742e0359_cryptolocker.exe
Size

33KB
MD5

834d5ea0cde765981364d059742e0359
SHA1

07d5034b0d6bd1455b6b569f4f724c3e1f5ab2ad
SHA256

8ed74937eef7bdf98f725b64ac9811427d67c4387d6f5604e0367303c49aa642
SHA512

d619d50594d48ee4a8fb7953928dc5bc0658eb5c93855b63d12251bebe90a350753ca6abbd5cf38bcac33af1fa5c171274907ce4f4b7848c524dc565763e071b
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUgIunIVpeNs23mAA6lJ:bA74zYcgT/Ekd0ryfjPIunqpeNswmq

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000012226-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2924	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2224	2024-03-12_834d5ea0cde765981364d059742e0359_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2924	2224	2024-03-12_834d5ea0cde765981364d059742e0359_cryptolocker.exe	28
PID 2224 wrote to memory of 2924	2224	2024-03-12_834d5ea0cde765981364d059742e0359_cryptolocker.exe	28
PID 2224 wrote to memory of 2924	2224	2024-03-12_834d5ea0cde765981364d059742e0359_cryptolocker.exe	28
PID 2224 wrote to memory of 2924	2224	2024-03-12_834d5ea0cde765981364d059742e0359_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-12_834d5ea0cde765981364d059742e0359_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-12_834d5ea0cde765981364d059742e0359_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
33KB

MD5
cab2e40adcdaf574b657dca4d8681384

SHA1
304b21b31a5c747bef6951d3b7d33ea635499ee4

SHA256
056ad93b3f07a4687e6849e31b246a3ba9b8b2a178de5192d33354c64eae86c4

SHA512
fe95ed502d98771969333a73f41bd6de4c9b6ef564e865a65e3b468ef288370d0d6b8c20aa30da71073cf3a0f5a90fff16cb71cd082c131ebce048e116c4cc72

Download Submit
memory/2224-0-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/2224-2-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/2224-1-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/2924-15-0x0000000001CE0000-0x0000000001CE6000-memory.dmp

Filesize
24KB

Download
memory/2924-22-0x0000000000580000-0x0000000000586000-memory.dmp

Filesize
24KB

Download