a24911daf1662ecbc3750243fb75486d5a071fad67df23370dfe5d402ae4d2fe

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 04:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-13_5815fba7b5ab13401956fce3f99a76be_cryptolocker.exe
Size

387KB
MD5

5815fba7b5ab13401956fce3f99a76be
SHA1

da3922057b8a12bb01e9314d4071af19308cefff
SHA256

a24911daf1662ecbc3750243fb75486d5a071fad67df23370dfe5d402ae4d2fe
SHA512

e325ab887435228db083face659e27158b4ead71b2a34561bc151865bcfd0fa5d300bf28b0904bb0c9eda04a2ac4393282868f4e64c6a893f7151b5bfff191e6
SSDEEP

6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzXp:nnOflT/ZFIjBz3xjTxynGUOUhXp

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001224f-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2544	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2036	2024-03-13_5815fba7b5ab13401956fce3f99a76be_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2544	2036	2024-03-13_5815fba7b5ab13401956fce3f99a76be_cryptolocker.exe	28
PID 2036 wrote to memory of 2544	2036	2024-03-13_5815fba7b5ab13401956fce3f99a76be_cryptolocker.exe	28
PID 2036 wrote to memory of 2544	2036	2024-03-13_5815fba7b5ab13401956fce3f99a76be_cryptolocker.exe	28
PID 2036 wrote to memory of 2544	2036	2024-03-13_5815fba7b5ab13401956fce3f99a76be_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-13_5815fba7b5ab13401956fce3f99a76be_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-13_5815fba7b5ab13401956fce3f99a76be_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
387KB

MD5
7d444a3f21a0d3d47c4e693d52295d1b

SHA1
3df219a7f34ad939599b80e45f13aaaf6400b14a

SHA256
44dc367e70ef1ee9179a6ea4e9a7ecd5fcd9c9890dd4a9da280ff15ee75c4978

SHA512
5d55ec872ee1d111892ef7d589f0de5932f3c3385e2a01244058d1f78011777ef83d48718291f461744773b46c37fb793ca4188b55d705cf72de5b98ca149c33

Download Submit
memory/2036-0-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2036-1-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2036-7-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2544-15-0x0000000001CB0000-0x0000000001CB6000-memory.dmp

Filesize
24KB

Download
memory/2544-18-0x0000000001CA0000-0x0000000001CA6000-memory.dmp

Filesize
24KB

Download