Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 13:00
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-18_e1179dabb7439761773b36eb8fc0a455_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-18_e1179dabb7439761773b36eb8fc0a455_cryptolocker.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-18_e1179dabb7439761773b36eb8fc0a455_cryptolocker.exe
-
Size
38KB
-
MD5
e1179dabb7439761773b36eb8fc0a455
-
SHA1
db84465006e00766f5c3c04b93351aec9c9d77d3
-
SHA256
490aca481b07a8274bdad162d4297d5b4ba34e8fd4adef4d2f91a4166ecc194d
-
SHA512
db044279f27d536750bb3bff8ae58bd0c85164d8dd5f6c581dca5f0ddf58eb6f91d198dcf7e93d5ba23ca8ab670d8b2e27a8999c6ec5478e1c7ef6c206928800
-
SSDEEP
768:bA74zYcgT/Ekd0ryfjPIunqpeNswmxT4HmS:bA6YcA/X6G0W1BGS
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x000800000001222d-10.dat CryptoLocker_rule2 -
Executes dropped EXE 1 IoCs
pid Process 3012 hasfj.exe -
Loads dropped DLL 1 IoCs
pid Process 2484 2024-04-18_e1179dabb7439761773b36eb8fc0a455_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2484 wrote to memory of 3012 2484 2024-04-18_e1179dabb7439761773b36eb8fc0a455_cryptolocker.exe 28 PID 2484 wrote to memory of 3012 2484 2024-04-18_e1179dabb7439761773b36eb8fc0a455_cryptolocker.exe 28 PID 2484 wrote to memory of 3012 2484 2024-04-18_e1179dabb7439761773b36eb8fc0a455_cryptolocker.exe 28 PID 2484 wrote to memory of 3012 2484 2024-04-18_e1179dabb7439761773b36eb8fc0a455_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-18_e1179dabb7439761773b36eb8fc0a455_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-18_e1179dabb7439761773b36eb8fc0a455_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
PID:3012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD594bfe95833707757bcff2527b8f59fde
SHA143942a8584cb9fc3a62f0c6694cf3daccca09a03
SHA25668d133fe603e3625db5f7e5e0644600b63d12ea7d58a3ed570760bc3b4b68115
SHA5120e70ca1a099c8ecf4b47d960380297e3c9cc866c2a485056c8c3e3ad87505e9f76369cdf6f9d1019903f320623dfe9b1a7d6fa70c81f4e61102919904c98553e