9a066aca7d645a07399a755fcac920faf6e94bf0f289f3d0daf377a6895a757a

Analysis

max time kernel
147s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 15:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-17_cc6c12a5decf6d40155a21672312354f_cryptolocker.exe
Size

30KB
MD5

cc6c12a5decf6d40155a21672312354f
SHA1

3d524be0485eebcbf80cb438ddfc203fb073f676
SHA256

9a066aca7d645a07399a755fcac920faf6e94bf0f289f3d0daf377a6895a757a
SHA512

ca36cab8cf492b1445221d43359f355461f109f5b8833721bcf15d665e0ef25cb39b0e3530af0cca9ef7bc71d368a209b86a65e29466b00a6c2a05ef9082c32f
SSDEEP

384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUGTGE:bG74zYcgT/Ekd0ryfjF

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2468-0-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000d0000000122a8-11.dat	CryptoLocker_rule2
behavioral1/memory/2468-15-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2464-16-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2464-26-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2464	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2468	2024-04-17_cc6c12a5decf6d40155a21672312354f_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2464	2468	2024-04-17_cc6c12a5decf6d40155a21672312354f_cryptolocker.exe	28
PID 2468 wrote to memory of 2464	2468	2024-04-17_cc6c12a5decf6d40155a21672312354f_cryptolocker.exe	28
PID 2468 wrote to memory of 2464	2468	2024-04-17_cc6c12a5decf6d40155a21672312354f_cryptolocker.exe	28
PID 2468 wrote to memory of 2464	2468	2024-04-17_cc6c12a5decf6d40155a21672312354f_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-17_cc6c12a5decf6d40155a21672312354f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-17_cc6c12a5decf6d40155a21672312354f_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
31KB

MD5
d2bce9b35cf940c735993fe4bb514c4a

SHA1
e4eccf8717683cd3c49eaf59c7e94d7476384e77

SHA256
9b05e799409ec459710cc87d3bab4be1ac3d3ab9cc5170bcae9dbc93501691b2

SHA512
307d454b9ab5de5efc2fcb921c42917f5d80afaffac6407bdb45646c6cfcb9249b982be58602c0bbad920788017ee10fa96a4b1093d8f7bf8b61f9e273c28d5f

Download Submit
memory/2464-16-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2464-18-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2464-19-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2464-26-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2468-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2468-1-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2468-2-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2468-9-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2468-15-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download