Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15/03/2024, 13:41

General

  • Target

    2024-03-15_5dde0a380d252e4e51272f8754a983e1_cryptolocker.exe

  • Size

    37KB

  • MD5

    5dde0a380d252e4e51272f8754a983e1

  • SHA1

    dae1b1c82a1c2d7ca421d1c5ba3879f2f35dc275

  • SHA256

    f11ccb535657b25fc559bcf11c2651656715176528478f1a0eca0f2053fca469

  • SHA512

    ac029ea5a14cfc9adb816ace9959d85c91ec521e7d90af8d702c545b5962660221202305d4e656e23c2e1c115cd15d05991041d87bbb1f16ad4f2fecbf068a66

  • SSDEEP

    384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUgIunIVpeNs23mAA6luXIy:bA74zYcgT/Ekd0ryfjPIunqpeNswmNXJ

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-15_5dde0a380d252e4e51272f8754a983e1_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-15_5dde0a380d252e4e51272f8754a983e1_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2156
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:2932

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    37KB

    MD5

    d9cd407afa65af131dd71bf0bab20f5c

    SHA1

    85b8f502e2efb24e303530c9387d65f54cc3b115

    SHA256

    bbc0f1e2107bd1e15f111fe456cf5a7a4a53d53063f19859dc08545d5141a728

    SHA512

    a22249ac5c5a19d656bd66e301a48d95628e8e1841ff345821082db9293b4821ecdc170a5cf712b7dd8a79e7be7a72f53f77abd0ce493b2e89e3071685178e65

  • memory/2156-0-0x00000000002F0000-0x00000000002F6000-memory.dmp

    Filesize

    24KB

  • memory/2156-1-0x0000000000350000-0x0000000000356000-memory.dmp

    Filesize

    24KB

  • memory/2156-3-0x00000000002F0000-0x00000000002F6000-memory.dmp

    Filesize

    24KB

  • memory/2932-15-0x0000000001B80000-0x0000000001B86000-memory.dmp

    Filesize

    24KB

  • memory/2932-22-0x0000000000290000-0x0000000000296000-memory.dmp

    Filesize

    24KB