c6e8a07f1b0581c238d278c96fbcd4bd94365518644a4e62ce2528fc64fb126d

Analysis

max time kernel
148s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 04:38

Target

2024-05-04_59a69d3cdc90dda2a0468d1325bbe011_cryptolocker.exe
Size

31KB
MD5

59a69d3cdc90dda2a0468d1325bbe011
SHA1

16dd23650a1bce18532360a6b4992dca0fd6d4dd
SHA256

c6e8a07f1b0581c238d278c96fbcd4bd94365518644a4e62ce2528fc64fb126d
SHA512

f93b80aeebfb99372ce1dde079ff6eabe2c3265453da9921636555376f0f82ca62da7156a3ab28cb67f900055a4bedf10eb836d11d07dd5b9bbba5eb6ead975b
SSDEEP

384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUGTGXvf:bG74zYcgT/Ekd0ryfjkf

Score

9^/10

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2248-0-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000a00000001466c-11.dat	CryptoLocker_rule2
behavioral1/memory/2012-16-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2248-14-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2012-26-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2012	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2248	2024-05-04_59a69d3cdc90dda2a0468d1325bbe011_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2012	2248	2024-05-04_59a69d3cdc90dda2a0468d1325bbe011_cryptolocker.exe	28
PID 2248 wrote to memory of 2012	2248	2024-05-04_59a69d3cdc90dda2a0468d1325bbe011_cryptolocker.exe	28
PID 2248 wrote to memory of 2012	2248	2024-05-04_59a69d3cdc90dda2a0468d1325bbe011_cryptolocker.exe	28
PID 2248 wrote to memory of 2012	2248	2024-05-04_59a69d3cdc90dda2a0468d1325bbe011_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-04_59a69d3cdc90dda2a0468d1325bbe011_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-04_59a69d3cdc90dda2a0468d1325bbe011_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2012

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
31KB

MD5
c9df4fa1bfa9b2abe250244a84aaf0f4

SHA1
0b80283841147bba79e6fb1cc7077b0bd1ec44e7

SHA256
5bd21546a7811e4c181cd4af0bf1148b2e3a19509e807a8e42c5c756b3750a26

SHA512
68982d122f20ee2754f000c22e84887e6b3315f37847bcf4f44c16b1e1f9d382ceef8932df58fcabcc9351582726518e2dba920198f947ab6aa664e8bfb30446

Download Submit
memory/2012-16-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2012-19-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2012-18-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2012-26-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2248-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2248-2-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2248-1-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2248-9-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2248-14-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download