65b974d57318431e6ddc49f3df3637127697e82ada68bcf292e265446ecf6de2

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:55

Target

2024-05-23_d5037b5eb118299147cedc7a9b130ba9_cryptolocker.exe
Size

24KB
MD5

d5037b5eb118299147cedc7a9b130ba9
SHA1

2f67928e4fc8b99aa92a8f006b44e0a04432734c
SHA256

65b974d57318431e6ddc49f3df3637127697e82ada68bcf292e265446ecf6de2
SHA512

f3707373a7d31f5e45069c6b41ee721f61cfb4034ec56531e3551d8ca7c7af9bac9c5f98a1cd4e6e621c0a46868fba3dce43219af24c364cd349c0232383e9b6
SSDEEP

384:bVCPwFRuFn65arz1ZhdaXFXSCVQTLfjDp6HMmHBQ:bVCPwFRo6CpwXFXSqQXfjAsmHBQ

Score

9^/10

upx

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2236-0-0x0000000008000000-0x000000000800E000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2
behavioral1/memory/2236-15-0x0000000008000000-0x000000000800E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2496-17-0x0000000008000000-0x000000000800E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2496-26-0x0000000008000000-0x000000000800E000-memory.dmp	CryptoLocker_rule2

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2236-0-0x0000000008000000-0x000000000800E000-memory.dmp	UPX
C:\Users\Admin\AppData\Local\Temp\hasfj.exe	UPX
behavioral1/memory/2236-15-0x0000000008000000-0x000000000800E000-memory.dmp	UPX
behavioral1/memory/2496-17-0x0000000008000000-0x000000000800E000-memory.dmp	UPX
behavioral1/memory/2496-26-0x0000000008000000-0x000000000800E000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

2496 hasfj.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-23_d5037b5eb118299147cedc7a9b130ba9_cryptolocker.exe

pid process

2236 2024-05-23_d5037b5eb118299147cedc7a9b130ba9_cryptolocker.exe

pid	process
2496	hasfj.exe

pid	process
2236	2024-05-23_d5037b5eb118299147cedc7a9b130ba9_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2236-0-0x0000000008000000-0x000000000800E000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\hasfj.exe	upx
behavioral1/memory/2236-15-0x0000000008000000-0x000000000800E000-memory.dmp	upx
behavioral1/memory/2496-17-0x0000000008000000-0x000000000800E000-memory.dmp	upx
behavioral1/memory/2496-26-0x0000000008000000-0x000000000800E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-23_d5037b5eb118299147cedc7a9b130ba9_cryptolocker.exe

description	pid	process	target process
PID 2236 wrote to memory of 2496	2236	2024-05-23_d5037b5eb118299147cedc7a9b130ba9_cryptolocker.exe	hasfj.exe
PID 2236 wrote to memory of 2496	2236	2024-05-23_d5037b5eb118299147cedc7a9b130ba9_cryptolocker.exe	hasfj.exe
PID 2236 wrote to memory of 2496	2236	2024-05-23_d5037b5eb118299147cedc7a9b130ba9_cryptolocker.exe	hasfj.exe
PID 2236 wrote to memory of 2496	2236	2024-05-23_d5037b5eb118299147cedc7a9b130ba9_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:2496

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
Filesize
24KB

MD5
e00256bea40d575937a46aface4a744a

SHA1
edc11a58fc9d279bbc2e468be678c4282a85d5f4

SHA256
09aba149ba1580cdc9ad057bc9f893139bee2f1bea2105d38306817dcb73bceb

SHA512
18c035d4bc5c6c04c2235cd77b8b0811ac1f5d7e4a4e031dc7083c925e70b56ab417cd682dc6d40732ebde5a274c7e1bde60b50f08c8ce6ab5b803115a2324c8

Download Submit
memory/2236-0-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download
memory/2236-1-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2236-2-0x00000000002E0000-0x00000000002E6000-memory.dmp

Filesize
24KB

Download
memory/2236-9-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2236-15-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download
memory/2496-17-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download
memory/2496-26-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download