ace354d8ea091bd87182c4f841937f553e1a8fe353176512ea13ef013f5332e8

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 22:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-13_c7314b9f4018d287680a1af8eafa4034_cryptolocker.exe
Size

50KB
MD5

c7314b9f4018d287680a1af8eafa4034
SHA1

d49272c8b8ed0432b9d4f5a3333c0ec42eb2ec96
SHA256

ace354d8ea091bd87182c4f841937f553e1a8fe353176512ea13ef013f5332e8
SHA512

aba1df856b886982a9c458f959b13f677cd375e834b987656e2444d94f76ce2bfd0c791c4cf21846fded610dcba427c4e3ffaa4c02f024521964839dfb14fd55
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37Yl6dIKld5CSi9:bgGYcA/53GAA6y37Q6dI+d50

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001224f-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2148	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2932	2024-03-13_c7314b9f4018d287680a1af8eafa4034_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2148	2932	2024-03-13_c7314b9f4018d287680a1af8eafa4034_cryptolocker.exe	28
PID 2932 wrote to memory of 2148	2932	2024-03-13_c7314b9f4018d287680a1af8eafa4034_cryptolocker.exe	28
PID 2932 wrote to memory of 2148	2932	2024-03-13_c7314b9f4018d287680a1af8eafa4034_cryptolocker.exe	28
PID 2932 wrote to memory of 2148	2932	2024-03-13_c7314b9f4018d287680a1af8eafa4034_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-13_c7314b9f4018d287680a1af8eafa4034_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-13_c7314b9f4018d287680a1af8eafa4034_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
50KB

MD5
0df2d63edbb155dc82ea150d19d3d02d

SHA1
e20ec03e46af7a05e605e784906ab45447614635

SHA256
e8a6102dc5592725c672221deacf0520a8a3d783db3b552f7b5c7a861883286b

SHA512
41247aef3c37746658ad4a8356ffaedf3a8937995e559481a5932ae3e2b50b1896fa5a3cfb1c66b75050e4f34829553245ec191260a7ee04de677844b222bf15

Download Submit
memory/2148-15-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2148-17-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/2932-0-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2932-1-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2932-8-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download