Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 16:32
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-21_2dec9665629bef4d62e36cbe55982d86_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-21_2dec9665629bef4d62e36cbe55982d86_cryptolocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-21_2dec9665629bef4d62e36cbe55982d86_cryptolocker.exe
-
Size
33KB
-
MD5
2dec9665629bef4d62e36cbe55982d86
-
SHA1
e330a4ca8ce24d581eacb2938cb2ed0253ac06ac
-
SHA256
735400b5a20df635fdbe0785ea8753ef26403107d79c06f3288489b840c808dc
-
SHA512
d5a916cdf48ad1109a4bd103d65797df0400b7df9d17c7d9f90816895eaef8eb2d2f368fb329e56f0482f2881b225dc3fd17ff07b010dea22e47052a64369d2c
-
SSDEEP
384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUGTGXvxC:bG74zYcgT/Ekd0ryfjkA
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1744-0-0x0000000008000000-0x000000000800A000-memory.dmp CryptoLocker_rule2 \Users\Admin\AppData\Local\Temp\hasfj.exe CryptoLocker_rule2 behavioral1/memory/1744-15-0x0000000008000000-0x000000000800A000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2564-16-0x0000000008000000-0x000000000800A000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2564-26-0x0000000008000000-0x000000000800A000-memory.dmp CryptoLocker_rule2 -
Executes dropped EXE 1 IoCs
Processes:
hasfj.exepid process 2564 hasfj.exe -
Loads dropped DLL 1 IoCs
Processes:
2024-05-21_2dec9665629bef4d62e36cbe55982d86_cryptolocker.exepid process 1744 2024-05-21_2dec9665629bef4d62e36cbe55982d86_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-05-21_2dec9665629bef4d62e36cbe55982d86_cryptolocker.exedescription pid process target process PID 1744 wrote to memory of 2564 1744 2024-05-21_2dec9665629bef4d62e36cbe55982d86_cryptolocker.exe hasfj.exe PID 1744 wrote to memory of 2564 1744 2024-05-21_2dec9665629bef4d62e36cbe55982d86_cryptolocker.exe hasfj.exe PID 1744 wrote to memory of 2564 1744 2024-05-21_2dec9665629bef4d62e36cbe55982d86_cryptolocker.exe hasfj.exe PID 1744 wrote to memory of 2564 1744 2024-05-21_2dec9665629bef4d62e36cbe55982d86_cryptolocker.exe hasfj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_2dec9665629bef4d62e36cbe55982d86_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_2dec9665629bef4d62e36cbe55982d86_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\hasfj.exeFilesize
33KB
MD5f225da7418fef3a8cb73f5eb254c9c24
SHA1a42685f064d81f80ecb079d68eefbbb3f475311f
SHA2569157efbe96fef4001fa8d15226259b4ec06138fd9838ab1cb1ba654be02e9901
SHA5123b4a74e59903b2f2b7ec8aa09ebb4b25d25ed27078222084185b520306b314d8ca08f7ec882f1b2ba269c003ed5c13d5f61031bb47cf33c2423a32298b97c1b0
-
memory/1744-0-0x0000000008000000-0x000000000800A000-memory.dmpFilesize
40KB
-
memory/1744-1-0x0000000000380000-0x0000000000386000-memory.dmpFilesize
24KB
-
memory/1744-2-0x0000000000390000-0x0000000000396000-memory.dmpFilesize
24KB
-
memory/1744-9-0x0000000000380000-0x0000000000386000-memory.dmpFilesize
24KB
-
memory/1744-15-0x0000000008000000-0x000000000800A000-memory.dmpFilesize
40KB
-
memory/2564-16-0x0000000008000000-0x000000000800A000-memory.dmpFilesize
40KB
-
memory/2564-18-0x0000000001CB0000-0x0000000001CB6000-memory.dmpFilesize
24KB
-
memory/2564-25-0x0000000001CA0000-0x0000000001CA6000-memory.dmpFilesize
24KB
-
memory/2564-26-0x0000000008000000-0x000000000800A000-memory.dmpFilesize
40KB