09c539516b2c86f9437c9286d62728509200cd747f8b415cf775e33bebf92085

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-04-2024 02:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-30_8a4d02584791a05ff7b036d486e13d8b_cryptolocker.exe
Size

31KB
MD5

8a4d02584791a05ff7b036d486e13d8b
SHA1

63de549f675d1ff56c46fb0c9e23dcc5d320ddb0
SHA256

09c539516b2c86f9437c9286d62728509200cd747f8b415cf775e33bebf92085
SHA512

8ea3ce1c7e54b4359a8abbf7e4a8e9a6d7f1c9056fb0ee35cb6aa596b104935ecc38a8baba373ab710bdabc8cae9e8e12946663a8356983e73f63be0daaf4f78
SSDEEP

384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUGTGS5:bG74zYcgT/Ekd0ryfj/

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2868-0-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000b00000001267a-11.dat	CryptoLocker_rule2
behavioral1/memory/2868-14-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2356-16-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2356-26-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2356	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2868	2024-04-30_8a4d02584791a05ff7b036d486e13d8b_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2356	2868	2024-04-30_8a4d02584791a05ff7b036d486e13d8b_cryptolocker.exe	28
PID 2868 wrote to memory of 2356	2868	2024-04-30_8a4d02584791a05ff7b036d486e13d8b_cryptolocker.exe	28
PID 2868 wrote to memory of 2356	2868	2024-04-30_8a4d02584791a05ff7b036d486e13d8b_cryptolocker.exe	28
PID 2868 wrote to memory of 2356	2868	2024-04-30_8a4d02584791a05ff7b036d486e13d8b_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-30_8a4d02584791a05ff7b036d486e13d8b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-30_8a4d02584791a05ff7b036d486e13d8b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
31KB

MD5
2fabceba1c4003702d6873ceae771ce7

SHA1
4532febed29feed1fc3902acf54b6ac637dade07

SHA256
f1e9d31e00f62167b25786e49146719b9e19c5ae0836c429d69f037c429b6154

SHA512
11cb6dffa050e8510b50fb38a0b09f361d46303bd78a239059a281f9c90f1aba7de79d13b1b3907a16a8758393decd37bbc85fe5352559a20bbeedcfe78c0e75

Download Submit
memory/2356-16-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2356-18-0x0000000000500000-0x0000000000506000-memory.dmp

Filesize
24KB

Download
memory/2356-25-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/2356-26-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2868-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2868-9-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2868-2-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/2868-1-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2868-14-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download