abeaffb3c6f14133aaf356c212095d5540dc74d587683d201a9c2f8bf0e2ed4f

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 07:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-27_90590621942cef2b2d3a9c5a94a82402_cryptolocker.exe
Size

32KB
MD5

90590621942cef2b2d3a9c5a94a82402
SHA1

415ca5a6ddff624b8174d37792698f2f31134cad
SHA256

abeaffb3c6f14133aaf356c212095d5540dc74d587683d201a9c2f8bf0e2ed4f
SHA512

50f3d4ced2698da513c387932b30f2488b00218238005085cc843ad2c6d45dd12c4127c0037068509d83268d1134188459e965a39f99e00b1df4a46f236b8370
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUr766SJ/Tl+bltoGkUT:bA74zYcgT/Ekd0ryfjQRSlwltYUT

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001224c-13.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2628	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2600	2024-03-27_90590621942cef2b2d3a9c5a94a82402_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2628	2600	2024-03-27_90590621942cef2b2d3a9c5a94a82402_cryptolocker.exe	28
PID 2600 wrote to memory of 2628	2600	2024-03-27_90590621942cef2b2d3a9c5a94a82402_cryptolocker.exe	28
PID 2600 wrote to memory of 2628	2600	2024-03-27_90590621942cef2b2d3a9c5a94a82402_cryptolocker.exe	28
PID 2600 wrote to memory of 2628	2600	2024-03-27_90590621942cef2b2d3a9c5a94a82402_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-27_90590621942cef2b2d3a9c5a94a82402_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-27_90590621942cef2b2d3a9c5a94a82402_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
32KB

MD5
6e86abed78da71be5cc7641b4653d054

SHA1
1c909953b61a7af13687e0cb3addfd850393a6a1

SHA256
cd08543eea983810720cfb3b00390643580284bab8046a1ab3d68a8497d408d6

SHA512
8d1cd676310ff97654025d076b865eaf92a409110978c4692696a71a56ffeeb79fa84a8f16a3e0fffe5b0833889042bb35b391df038f358f9f27404dcc213155

Download Submit
memory/2600-0-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2600-2-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2600-1-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2628-15-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2628-18-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download