19e48c26d9243f90ec6b72462211509a5cf94bd32d7d6e0ea528a1b154fb1724

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-08_a5f9718baff1bcbaff5405c28ac8d686_cryptolocker.exe
Size

49KB
MD5

a5f9718baff1bcbaff5405c28ac8d686
SHA1

4d4a7867fc2eab44c99b987902716b9a0db7b34d
SHA256

19e48c26d9243f90ec6b72462211509a5cf94bd32d7d6e0ea528a1b154fb1724
SHA512

bcdc2eb00fb31e969924ea51e0928de6eb90111a9189205682ca90b9bdfd6faafa8317f85835897febaca7fd926e6953db4bbc97e25b9e49d2f728252bf1fc8d
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37YbDu5z/hvvkD98i:bgGYcA/53GAA6y37nby8i

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000012265-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2376	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
1960	2024-04-08_a5f9718baff1bcbaff5405c28ac8d686_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2376	1960	2024-04-08_a5f9718baff1bcbaff5405c28ac8d686_cryptolocker.exe	28
PID 1960 wrote to memory of 2376	1960	2024-04-08_a5f9718baff1bcbaff5405c28ac8d686_cryptolocker.exe	28
PID 1960 wrote to memory of 2376	1960	2024-04-08_a5f9718baff1bcbaff5405c28ac8d686_cryptolocker.exe	28
PID 1960 wrote to memory of 2376	1960	2024-04-08_a5f9718baff1bcbaff5405c28ac8d686_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-08_a5f9718baff1bcbaff5405c28ac8d686_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-08_a5f9718baff1bcbaff5405c28ac8d686_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
49KB

MD5
b314b981e8bc2dd6fcee610419ba994a

SHA1
43e68266821f10b4038578effc1a09dded755851

SHA256
cf3901ee9a7657cbb504011a6dfaf610dac3a860c8e56a792c9bed797861864a

SHA512
2927f3f6654e302c5aa680dc6c1357e472f4d896e94d1aaff480ff23e8ef3d19153ea56892ad93fb0cedca2d9275e411582406ba11e9b9a4a210f752b800c3ce

Download Submit
memory/1960-0-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/1960-1-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/1960-3-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2376-15-0x0000000001CA0000-0x0000000001CA6000-memory.dmp

Filesize
24KB

Download
memory/2376-19-0x00000000006E0000-0x00000000006E6000-memory.dmp

Filesize
24KB

Download