67e186e160b03e8b473a6099bbdc15453e697d5b3c2895d01451d3b94b085160

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20240517aef78f46044d7cd4000c244e07cb0e91cryptolocker.exe
Size

25KB
MD5

aef78f46044d7cd4000c244e07cb0e91
SHA1

6f91ce25fc3a7888d7ca1b78428f760c77f6c5e8
SHA256

67e186e160b03e8b473a6099bbdc15453e697d5b3c2895d01451d3b94b085160
SHA512

a566886eff4edb6dc88dd3571dd1a66759d8b110c9739f1851f04bc08e3613c9120b5e77e796543febc57b3f810d9b21daccf18c4dae97e6ee0b31fce829f37f
SSDEEP

384:bVCPwFRuFn65arz1ZhdaXFXSCVQTLfjDp6HnpObd:bVCPwFRo6CpwXFXSqQXfjAHAp

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2608	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2392	20240517aef78f46044d7cd4000c244e07cb0e91cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2392-0-0x0000000008000000-0x000000000800E000-memory.dmp	upx
behavioral1/files/0x000a00000001226d-11.dat	upx
behavioral1/memory/2608-17-0x0000000008000000-0x000000000800E000-memory.dmp	upx
behavioral1/memory/2392-16-0x0000000008000000-0x000000000800E000-memory.dmp	upx
behavioral1/memory/2608-27-0x0000000008000000-0x000000000800E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2608	2392	20240517aef78f46044d7cd4000c244e07cb0e91cryptolocker.exe	28
PID 2392 wrote to memory of 2608	2392	20240517aef78f46044d7cd4000c244e07cb0e91cryptolocker.exe	28
PID 2392 wrote to memory of 2608	2392	20240517aef78f46044d7cd4000c244e07cb0e91cryptolocker.exe	28
PID 2392 wrote to memory of 2608	2392	20240517aef78f46044d7cd4000c244e07cb0e91cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\20240517aef78f46044d7cd4000c244e07cb0e91cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\20240517aef78f46044d7cd4000c244e07cb0e91cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
25KB

MD5
081452d0f0ce0ba0b44ddccf0bebf672

SHA1
ba7ab082a343d6f7b78cfd85a6593aff4862b7a3

SHA256
2a563793673ab1b222440d0e8380e5db0f1c4c2e779c706ccdbc412f431568bc

SHA512
3636f0086874a2d06ce7ee26ec2c37aae8d5685ea488a0a7e05a5afddaa7f851e56f10d3f8cb9a193b7e88f42e01201acbb927b0145d4e594f48966e5dc9a183

Download Submit
memory/2392-0-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download
memory/2392-1-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2392-9-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2392-2-0x0000000000500000-0x0000000000506000-memory.dmp

Filesize
24KB

Download
memory/2392-16-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download
memory/2608-17-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download
memory/2608-26-0x0000000001BC0000-0x0000000001BC6000-memory.dmp

Filesize
24KB

Download
memory/2608-19-0x0000000001BD0000-0x0000000001BD6000-memory.dmp

Filesize
24KB

Download
memory/2608-27-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download