a1ea7a6d6b03111b859c24afea4ec1448e88bd9981f7c2be4a19f76e271f7f43

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 22:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_1c93822894bd8c41cee14730524ff136_cryptolocker.exe
Size

23KB
MD5

1c93822894bd8c41cee14730524ff136
SHA1

32a064513854d047b0e7eac2ef441739eb6982b2
SHA256

a1ea7a6d6b03111b859c24afea4ec1448e88bd9981f7c2be4a19f76e271f7f43
SHA512

f97ba6059062ec46e4d751d986295f3d4a0276cc97be8e011949fff72a3d4b5050fd40dbec6d0f86425ee1e4d7d3f60b7dc231de7407742a10eaafee55c86151
SSDEEP

384:bVCPwFRuFn65arz1ZhdaXFXSCVQTLfjDp6HMJ5:bVCPwFRo6CpwXFXSqQXfjAsJ5

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2972-0-0x0000000008000000-0x000000000800E000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000b00000001227d-11.dat	CryptoLocker_rule2
behavioral1/memory/1884-17-0x0000000008000000-0x000000000800E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2972-16-0x0000000008000000-0x000000000800E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1884-27-0x0000000008000000-0x000000000800E000-memory.dmp	CryptoLocker_rule2

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral1/memory/2972-0-0x0000000008000000-0x000000000800E000-memory.dmp	UPX
behavioral1/files/0x000b00000001227d-11.dat	UPX
behavioral1/memory/1884-17-0x0000000008000000-0x000000000800E000-memory.dmp	UPX
behavioral1/memory/2972-16-0x0000000008000000-0x000000000800E000-memory.dmp	UPX
behavioral1/memory/1884-27-0x0000000008000000-0x000000000800E000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
1884	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2972	2024-05-23_1c93822894bd8c41cee14730524ff136_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2972-0-0x0000000008000000-0x000000000800E000-memory.dmp	upx
behavioral1/files/0x000b00000001227d-11.dat	upx
behavioral1/memory/1884-17-0x0000000008000000-0x000000000800E000-memory.dmp	upx
behavioral1/memory/2972-16-0x0000000008000000-0x000000000800E000-memory.dmp	upx
behavioral1/memory/1884-27-0x0000000008000000-0x000000000800E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 1884	2972	2024-05-23_1c93822894bd8c41cee14730524ff136_cryptolocker.exe	28
PID 2972 wrote to memory of 1884	2972	2024-05-23_1c93822894bd8c41cee14730524ff136_cryptolocker.exe	28
PID 2972 wrote to memory of 1884	2972	2024-05-23_1c93822894bd8c41cee14730524ff136_cryptolocker.exe	28
PID 2972 wrote to memory of 1884	2972	2024-05-23_1c93822894bd8c41cee14730524ff136_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-23_1c93822894bd8c41cee14730524ff136_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_1c93822894bd8c41cee14730524ff136_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
23KB

MD5
5f59d75598a9d6005814bdd60e76c527

SHA1
3f191e974174b363a7400314c4139d8bb0a7048c

SHA256
d1b243c005174f64328cb846739fb241d6278f466ab33fe704d8978ee76ce135

SHA512
7d671a9636168df9a631f34090f4cedf26c7b823bd44bd92e6f427cdeebcfe312dfb9b82eac737e37fcccc82a72553903fd53fa171efc349486a322fae7904f6

Download Submit
memory/1884-17-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download
memory/1884-19-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1884-26-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/1884-27-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download
memory/2972-0-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download
memory/2972-2-0x00000000004C0000-0x00000000004C6000-memory.dmp

Filesize
24KB

Download
memory/2972-9-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/2972-1-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/2972-16-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download