094ddad5a7c84cce0afbe8e19836e263cd4cf11bc52397135a29982b42886fdd

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 22:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-25_803687ebbc6fe8709d6e8989f5435f32_cryptolocker.exe
Size

32KB
MD5

803687ebbc6fe8709d6e8989f5435f32
SHA1

ae3d50f893240ce26dea5675587bee459e51e46e
SHA256

094ddad5a7c84cce0afbe8e19836e263cd4cf11bc52397135a29982b42886fdd
SHA512

50fc337fb6cfd97d430b02df77b722457cd2a72bc999ba183a9bd53c6bd34e503cc6355161df8d511b8b53146ec3b85c4d1e47b915396f42ea3be5de93b4d689
SSDEEP

384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUGTGXua6:bG74zYcgT/Ekd0ryfjL

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2936-0-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000e00000001214d-11.dat	CryptoLocker_rule2
behavioral1/memory/2108-16-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2936-15-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2108-26-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2108	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2936	2024-05-25_803687ebbc6fe8709d6e8989f5435f32_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2108	2936	2024-05-25_803687ebbc6fe8709d6e8989f5435f32_cryptolocker.exe	28
PID 2936 wrote to memory of 2108	2936	2024-05-25_803687ebbc6fe8709d6e8989f5435f32_cryptolocker.exe	28
PID 2936 wrote to memory of 2108	2936	2024-05-25_803687ebbc6fe8709d6e8989f5435f32_cryptolocker.exe	28
PID 2936 wrote to memory of 2108	2936	2024-05-25_803687ebbc6fe8709d6e8989f5435f32_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-25_803687ebbc6fe8709d6e8989f5435f32_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-25_803687ebbc6fe8709d6e8989f5435f32_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
32KB

MD5
f2c8942ad4202dcace22d6d322e52ddb

SHA1
f9bef218ed23df78fa44ae03866f0062434f2c76

SHA256
6393a800020dd26b1ab29f9da49fba5f39587efe180444388c0866fe52cd14ec

SHA512
71814262bb8ca6cd96c668c9e586a61056fef3fccb14f03bd21f0b93a080dfe084de3b2aed0ea25e83d87ff5974513562cb29342fd38b4368c140df8cc49ff59

Download Submit
memory/2108-16-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2108-25-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/2108-18-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2108-26-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2936-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2936-1-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download
memory/2936-9-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download
memory/2936-2-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/2936-15-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download