65bad19ef52a603e5665a3aca6b8a2b131c66a243ae72065df937e51c66fd28f

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 09:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-29_eb149247ddcc39ae1d20e050af611be9_cryptolocker.exe
Size

31KB
MD5

eb149247ddcc39ae1d20e050af611be9
SHA1

bf1384b05a6982c732349eca02fc87079af9cee1
SHA256

65bad19ef52a603e5665a3aca6b8a2b131c66a243ae72065df937e51c66fd28f
SHA512

7a7d62645bd9bfe542cc1cff0448ac64c8b79035d58bb0a9dee17a4026dda50e24cbd81250a13fada7244bc5accc49b73775c0ce38ae919ad122839623df7825
SSDEEP

384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUGTGex:bG74zYcgT/Ekd0ryfjt

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 6 IoCs

resource	yara_rule
behavioral1/memory/2748-0-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000b000000014323-11.dat	CryptoLocker_rule2
behavioral1/memory/2748-12-0x0000000001DF0000-0x0000000001DFA000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2748-16-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2856-17-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2856-27-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2856	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2748	2024-04-29_eb149247ddcc39ae1d20e050af611be9_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2856	2748	2024-04-29_eb149247ddcc39ae1d20e050af611be9_cryptolocker.exe	28
PID 2748 wrote to memory of 2856	2748	2024-04-29_eb149247ddcc39ae1d20e050af611be9_cryptolocker.exe	28
PID 2748 wrote to memory of 2856	2748	2024-04-29_eb149247ddcc39ae1d20e050af611be9_cryptolocker.exe	28
PID 2748 wrote to memory of 2856	2748	2024-04-29_eb149247ddcc39ae1d20e050af611be9_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-29_eb149247ddcc39ae1d20e050af611be9_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-29_eb149247ddcc39ae1d20e050af611be9_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
31KB

MD5
40b2d80749f0f2fe6e4334b931a0a5e3

SHA1
f5d4bb6c5fcc2fea6af610f6af761ed0b5c18339

SHA256
db9cc82c295172e32f3a6ed10fea283495aeea16077459b255c526c56f020d84

SHA512
0b39c0227da51163fd0aecebf93cb4d49f2ba000bde74687fb861287961943a93ad0a5c636ff1d80d120ebb2a52d133523ebba9fea022502d4ed2b3908808d21

Download Submit
memory/2748-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2748-1-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2748-2-0x00000000003A0000-0x00000000003A6000-memory.dmp

Filesize
24KB

Download
memory/2748-9-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2748-12-0x0000000001DF0000-0x0000000001DFA000-memory.dmp

Filesize
40KB

Download
memory/2748-16-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2856-17-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2856-19-0x0000000001C70000-0x0000000001C76000-memory.dmp

Filesize
24KB

Download
memory/2856-26-0x0000000001C60000-0x0000000001C66000-memory.dmp

Filesize
24KB

Download
memory/2856-27-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download