7d4af2d26a655bdc41dcd204caea01615b7c235156168cec9f4285f8b791d10a

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 03:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-09_766b6694b3bcd41dc7c151419fbf9024_cryptolocker.exe
Size

388KB
MD5

766b6694b3bcd41dc7c151419fbf9024
SHA1

faa6cec751f5b0682b9636827e514e4dd0daaa36
SHA256

7d4af2d26a655bdc41dcd204caea01615b7c235156168cec9f4285f8b791d10a
SHA512

f964a28a6155d4617fd5e3810860508727bde60a48476625a10583ad13cac2095f67bc1e4ac5d1ff0e39313fd07c2842997b29782b4e7b6409b9df3d0b56fd38
SSDEEP

6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzX3:nnOflT/ZFIjBz3xjTxynGUOUhX3

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000900000001227e-13.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2260	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
1948	2024-04-09_766b6694b3bcd41dc7c151419fbf9024_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2260	1948	2024-04-09_766b6694b3bcd41dc7c151419fbf9024_cryptolocker.exe	28
PID 1948 wrote to memory of 2260	1948	2024-04-09_766b6694b3bcd41dc7c151419fbf9024_cryptolocker.exe	28
PID 1948 wrote to memory of 2260	1948	2024-04-09_766b6694b3bcd41dc7c151419fbf9024_cryptolocker.exe	28
PID 1948 wrote to memory of 2260	1948	2024-04-09_766b6694b3bcd41dc7c151419fbf9024_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-09_766b6694b3bcd41dc7c151419fbf9024_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-09_766b6694b3bcd41dc7c151419fbf9024_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
388KB

MD5
cfa417b161e110e7bc410d8523c00535

SHA1
d1ac9f02d16bb8eb94cf40b191622afae6af2fff

SHA256
e3033656ef56f806e536dd1c4abbf2d145738027feccec55c629954888a92759

SHA512
061245c27277a52874a198d2522815f912b91d178bda4528aa69e95c20efaa61e7dbc7db8ef66376d67b41bd564eb4c01083ddc15704203456584041416309ea

Download Submit
memory/1948-0-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/1948-2-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/1948-1-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2260-15-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/2260-22-0x0000000000260000-0x0000000000266000-memory.dmp

Filesize
24KB

Download