8d2ab61164f38c99cb26e570c1d39186c1473bf935cc17b4b85a4b2f264599be

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 11:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-14_aeae15e4be2b64f982081c3f2718d5d2_cryptolocker.exe
Size

38KB
MD5

aeae15e4be2b64f982081c3f2718d5d2
SHA1

012adfb1a0eda294bcd35d2d1f3d8be5851af3f0
SHA256

8d2ab61164f38c99cb26e570c1d39186c1473bf935cc17b4b85a4b2f264599be
SHA512

93aa48d732d976fbec9dd90df1ef703fdcaeb70be63e4affa589b92731a2639328bca0eba2d48d01d44619428974ab971f94ac12a4de93ea6c828d87ca9010b0
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf0w3sp8u5cZnfXh:bgX4zYcgTEu6QOaryfjqDDw3sCu5mXh

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001224f-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
1836	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
1996	2024-03-14_aeae15e4be2b64f982081c3f2718d5d2_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1836	1996	2024-03-14_aeae15e4be2b64f982081c3f2718d5d2_cryptolocker.exe	28
PID 1996 wrote to memory of 1836	1996	2024-03-14_aeae15e4be2b64f982081c3f2718d5d2_cryptolocker.exe	28
PID 1996 wrote to memory of 1836	1996	2024-03-14_aeae15e4be2b64f982081c3f2718d5d2_cryptolocker.exe	28
PID 1996 wrote to memory of 1836	1996	2024-03-14_aeae15e4be2b64f982081c3f2718d5d2_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-14_aeae15e4be2b64f982081c3f2718d5d2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-14_aeae15e4be2b64f982081c3f2718d5d2_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
39KB

MD5
383ac4a5bca0304daac8b1d67c1a5493

SHA1
23ee03542663329565ae508c9d67ddab5a7812cf

SHA256
c0018f5d256a62c92a949e752e87aff76fb1644a92c1f254da89e7beec4bdad7

SHA512
c64d16658ad15578b40fc594621190d0a24e074b02d9bf71bf071df36d34cbf1ec96cee4823b833350373a58a45b02ca0096e8b540a8b0781133d3c2799c7b0f

Download Submit
memory/1836-15-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/1836-17-0x0000000000570000-0x0000000000576000-memory.dmp

Filesize
24KB

Download
memory/1996-0-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/1996-1-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/1996-4-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download