b1eaf0bb2c52a954f6cf14d5fb11e21256e5569ec9c63fa869d2a1d4e1de2c67

Analysis

max time kernel
148s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-20_408847629c66dee431991b9037efc2ff_cryptolocker.exe
Size

41KB
MD5

408847629c66dee431991b9037efc2ff
SHA1

5d53649cab20b336f578c7842d49337598f099bd
SHA256

b1eaf0bb2c52a954f6cf14d5fb11e21256e5569ec9c63fa869d2a1d4e1de2c67
SHA512

85598bd4a3e125b8da0e2093fdad06f16dc55959a1ba8f37622d17fa8bd11728843f82da16b4643ef55ab4a3122061e5143a0eacc3bf048bf78ccdbf8cefcacd
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDDw3sCu5b+rc5vVcSQ:bgGYcA/53GADw8ClrcTcSQ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000014466-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2564	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
1760	2024-04-20_408847629c66dee431991b9037efc2ff_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2564	1760	2024-04-20_408847629c66dee431991b9037efc2ff_cryptolocker.exe	28
PID 1760 wrote to memory of 2564	1760	2024-04-20_408847629c66dee431991b9037efc2ff_cryptolocker.exe	28
PID 1760 wrote to memory of 2564	1760	2024-04-20_408847629c66dee431991b9037efc2ff_cryptolocker.exe	28
PID 1760 wrote to memory of 2564	1760	2024-04-20_408847629c66dee431991b9037efc2ff_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-20_408847629c66dee431991b9037efc2ff_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-20_408847629c66dee431991b9037efc2ff_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
41KB

MD5
5cf905c14a2299c2a65c6ba8df7944c3

SHA1
3ec254046dd481eb84f79d24dba3a1127f11aaa5

SHA256
43849038d784f2d270a346957f8d5b6dfac230186744147b80965eb38d8d1555

SHA512
041fb9c60e6d2b1d17954ea937501b1a18e7b7a8a9f1a48d681c9e9a13491afb64c00a76965cf4b3ce850710a4411f1e295b23de7fe6e84a0d78a94cf3dfffe5

Download Submit
memory/1760-0-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/1760-1-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/1760-3-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/2564-16-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2564-15-0x0000000000570000-0x0000000000576000-memory.dmp

Filesize
24KB

Download