4ae40a047337f646791bf9dcb2a866c9ccacf56cee8ff0e8bc963455cad512c6

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 04:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-16_ddc156703438a5c4b71932ad0ec0e348_cryptolocker.exe
Size

36KB
MD5

ddc156703438a5c4b71932ad0ec0e348
SHA1

0f49ffc27264cea5e310ea366b8cc97a4584dcd1
SHA256

4ae40a047337f646791bf9dcb2a866c9ccacf56cee8ff0e8bc963455cad512c6
SHA512

c4e4468845350c3a1b2d097cd0dc88df360e573cc945cc3db38f8671e70632f94bed70d94ec618751386bc7bb70afb967946f960a94a0a34757555b63b626b82
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUqMV6U8zKvGaLigYqVwX1h:bA74zYcgT/Ekd0ryfj86U8zbUYqSFh

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012267-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2984	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2368	2024-03-16_ddc156703438a5c4b71932ad0ec0e348_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2984	2368	2024-03-16_ddc156703438a5c4b71932ad0ec0e348_cryptolocker.exe	28
PID 2368 wrote to memory of 2984	2368	2024-03-16_ddc156703438a5c4b71932ad0ec0e348_cryptolocker.exe	28
PID 2368 wrote to memory of 2984	2368	2024-03-16_ddc156703438a5c4b71932ad0ec0e348_cryptolocker.exe	28
PID 2368 wrote to memory of 2984	2368	2024-03-16_ddc156703438a5c4b71932ad0ec0e348_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-16_ddc156703438a5c4b71932ad0ec0e348_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-16_ddc156703438a5c4b71932ad0ec0e348_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
36KB

MD5
063ad87fdf0e3c5a6de6284913c10ecd

SHA1
5de72182c3f2bf1e18dd7422c458c8089f403367

SHA256
662b44b4058e8830bb417526cd865f6b1137707c77d48d6c2ca647b587a5c7fc

SHA512
81ff2a2d50b18627f55766c3bc57de99a705faa574586114041584653579e55b557c80cb5346a33b41161d522b33d311e7263f48e064072ab7bb7dd171fa9fff

Download Submit
memory/2368-0-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2368-1-0x0000000000810000-0x0000000000816000-memory.dmp

Filesize
24KB

Download
memory/2368-2-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2984-15-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download
memory/2984-17-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download