7a583e0a4917f6121cceac8b9e740845490bc7f6293deea58080a09761c3fa6f

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-03-2024 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-12_f74ff627203cd7d89da89e5bb3ec3e13_cryptolocker.exe
Size

38KB
MD5

f74ff627203cd7d89da89e5bb3ec3e13
SHA1

215d319f53d5df0af4a86e62cc0a0472c04feb4e
SHA256

7a583e0a4917f6121cceac8b9e740845490bc7f6293deea58080a09761c3fa6f
SHA512

da70b372698f294bd0a124913e88d214875f908afea506ca9063b950cd37e66f5b2ada2f70f416ac5aaff9275b3a01c070d55dc6177ecaa52ef516ca6c9c60a8
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf0w3sp8u5cZnfVu/xnu:bgX4zYcgTEu6QOaryfjqDDw3sCu5mU8

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012241-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2120	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
1784	2024-03-12_f74ff627203cd7d89da89e5bb3ec3e13_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 2120	1784	2024-03-12_f74ff627203cd7d89da89e5bb3ec3e13_cryptolocker.exe	28
PID 1784 wrote to memory of 2120	1784	2024-03-12_f74ff627203cd7d89da89e5bb3ec3e13_cryptolocker.exe	28
PID 1784 wrote to memory of 2120	1784	2024-03-12_f74ff627203cd7d89da89e5bb3ec3e13_cryptolocker.exe	28
PID 1784 wrote to memory of 2120	1784	2024-03-12_f74ff627203cd7d89da89e5bb3ec3e13_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-12_f74ff627203cd7d89da89e5bb3ec3e13_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-12_f74ff627203cd7d89da89e5bb3ec3e13_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
38KB

MD5
c0f682c41e5b54d30e178e1eb6ce0f06

SHA1
e3cf01b75d3f656d52c589c6503ef5cdecaea6ce

SHA256
28d2169f0665ecf913f6dda8693ea7ee32b1037ebd5d11ad0896e641a14a754a

SHA512
65dba17fa39de8b6b8d5ca271e09e7018b32298e80a5a8b39159a3a7f114a727e01f5243f74a12b7e1dc45761249e624a0105f623089b4e64d03292a6a979309

Download Submit
memory/1784-0-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/1784-2-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/1784-1-0x0000000001CA0000-0x0000000001CA6000-memory.dmp

Filesize
24KB

Download
memory/2120-15-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2120-17-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download