a00d9d017707b17fb4186556d72d086a7552b82874ced9c5d83c65a2d818e5be

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-03-2024 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-29_41898732dcd0213ea63b6c6d9c4623ae_cryptolocker.exe
Size

387KB
MD5

41898732dcd0213ea63b6c6d9c4623ae
SHA1

7e860f1514036578c30bbecf7bbd79140d7a4439
SHA256

a00d9d017707b17fb4186556d72d086a7552b82874ced9c5d83c65a2d818e5be
SHA512

e45b007309031134c2630366bb7a43cafff7a73358c5ff8aafbe3811c8be93671f770a0179093200343d65bd820c8dc715ff5f1a2aa74694bb1dd682e26ba591
SSDEEP

6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzXp:nnOflT/ZFIjBz3xjTxynGUOUhXp

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012245-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2488	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
1708	2024-03-29_41898732dcd0213ea63b6c6d9c4623ae_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2488	1708	2024-03-29_41898732dcd0213ea63b6c6d9c4623ae_cryptolocker.exe	28
PID 1708 wrote to memory of 2488	1708	2024-03-29_41898732dcd0213ea63b6c6d9c4623ae_cryptolocker.exe	28
PID 1708 wrote to memory of 2488	1708	2024-03-29_41898732dcd0213ea63b6c6d9c4623ae_cryptolocker.exe	28
PID 1708 wrote to memory of 2488	1708	2024-03-29_41898732dcd0213ea63b6c6d9c4623ae_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-29_41898732dcd0213ea63b6c6d9c4623ae_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-29_41898732dcd0213ea63b6c6d9c4623ae_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
387KB

MD5
84f5837f8570d49fb7bfaac8948a1a10

SHA1
cffc098ffc0029064dbc368d49edf0389da75e58

SHA256
0e1acd1f2c593609c0728989b7212f2fe2c4e10d27cc119c065343873c431a54

SHA512
fd50dcf47a90b7444a5ce05983002e414a7db34943b87cb60adf2cd1adfc70c2f2767f73931c2c49b71318a3a7d2fc04ab5e14023b64b4054e0b40a79877a994

Download Submit
memory/1708-0-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/1708-1-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/1708-2-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2488-15-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/2488-18-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download