ed60da319c0feb12e9c2ddda86fddd1182c9e3e9afcaa42c5da4415c8fb9149a

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-10_ba687c0b029f67afa18f2ac19350dce9_cryptolocker.exe
Size

21KB
MD5

ba687c0b029f67afa18f2ac19350dce9
SHA1

a9f714ede8fdd7f760324dbeeda20e9f0943e438
SHA256

ed60da319c0feb12e9c2ddda86fddd1182c9e3e9afcaa42c5da4415c8fb9149a
SHA512

ab82d42fd66891dd72b9c922b2530e3f6a51e4cb830a6e6033d1c6d88f72384369577a86d195e396eb7fd7150ba0e51ae9680da69ed6d1f8f3d97bfeecee2bb9
SSDEEP

384:bVCPwFRuFn65arz1ZhdaXFXSCVQTLfjDp6H+:bVCPwFRo6CpwXFXSqQXfjAe

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/2076-0-0x0000000008000000-0x000000000800E000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000b00000001224c-11.dat	CryptoLocker_rule2
behavioral1/memory/2076-14-0x0000000008000000-0x000000000800E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1904-25-0x0000000008000000-0x000000000800E000-memory.dmp	CryptoLocker_rule2

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/2076-0-0x0000000008000000-0x000000000800E000-memory.dmp	UPX
behavioral1/files/0x000b00000001224c-11.dat	UPX
behavioral1/memory/2076-14-0x0000000008000000-0x000000000800E000-memory.dmp	UPX
behavioral1/memory/1904-25-0x0000000008000000-0x000000000800E000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
1904	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2076	2024-04-10_ba687c0b029f67afa18f2ac19350dce9_cryptolocker.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2076-0-0x0000000008000000-0x000000000800E000-memory.dmp	upx
behavioral1/files/0x000b00000001224c-11.dat	upx
behavioral1/memory/2076-14-0x0000000008000000-0x000000000800E000-memory.dmp	upx
behavioral1/memory/1904-25-0x0000000008000000-0x000000000800E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1904	2076	2024-04-10_ba687c0b029f67afa18f2ac19350dce9_cryptolocker.exe	28
PID 2076 wrote to memory of 1904	2076	2024-04-10_ba687c0b029f67afa18f2ac19350dce9_cryptolocker.exe	28
PID 2076 wrote to memory of 1904	2076	2024-04-10_ba687c0b029f67afa18f2ac19350dce9_cryptolocker.exe	28
PID 2076 wrote to memory of 1904	2076	2024-04-10_ba687c0b029f67afa18f2ac19350dce9_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-10_ba687c0b029f67afa18f2ac19350dce9_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-10_ba687c0b029f67afa18f2ac19350dce9_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
22KB

MD5
307ab58f03ab734cc40588067a705d8f

SHA1
10ee46784b6304e6e157f969db618f8f1ebb6c7a

SHA256
942ddf16d81f1f902428a9609343b4633020b860ae47ba4d940b6798a9fa09d2

SHA512
170f4554d5b1afd7d7ba329ed432d75fbf17265b86ee1c08f3966a13dc097617a73a3a4aa7f48f2db74af55ae0748fa372e19424e0e928b3f59111e7b470eaf6

Download Submit
memory/1904-18-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/1904-17-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/1904-25-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download
memory/2076-0-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download
memory/2076-1-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/2076-3-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2076-2-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/2076-14-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download