819ec1acb1652c98c8c2b1f88c6688e58660063e1d1745447769eba74ba9f40a

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 04:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-29_9889f5d0bb3ba23f9d43fefa40eb3448_cryptolocker.exe
Size

43KB
MD5

9889f5d0bb3ba23f9d43fefa40eb3448
SHA1

c5020e0f276371f0e0e4585bd30a3fcb57ee1832
SHA256

819ec1acb1652c98c8c2b1f88c6688e58660063e1d1745447769eba74ba9f40a
SHA512

317e35be420fd397b209e1db671c233db5241156351d4c4fd7ff76037b0bc66b6c7950b7fd7967914259cbdd9d92efcef6e9887e01e2b6dff85162b02b13360b
SSDEEP

384:bm74uGLLQRcsdeQ72ngEr4K7YmE8uYo0nrlwfjDUTb:bm74zYcgT/Ek70ryfjMb

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/856-0-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/856-16-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x00090000000143d1-24.dat	CryptoLocker_rule2
behavioral1/memory/856-13-0x0000000001F30000-0x0000000001F3D000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2700-26-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2700	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
856	2024-05-29_9889f5d0bb3ba23f9d43fefa40eb3448_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 2700	856	2024-05-29_9889f5d0bb3ba23f9d43fefa40eb3448_cryptolocker.exe	28
PID 856 wrote to memory of 2700	856	2024-05-29_9889f5d0bb3ba23f9d43fefa40eb3448_cryptolocker.exe	28
PID 856 wrote to memory of 2700	856	2024-05-29_9889f5d0bb3ba23f9d43fefa40eb3448_cryptolocker.exe	28
PID 856 wrote to memory of 2700	856	2024-05-29_9889f5d0bb3ba23f9d43fefa40eb3448_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-29_9889f5d0bb3ba23f9d43fefa40eb3448_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-29_9889f5d0bb3ba23f9d43fefa40eb3448_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:856
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
43KB

MD5
7ce5d310bee309b0bb8f9642333693a6

SHA1
176f525a6d090d1bf454e3ca8209716d0b36ca85

SHA256
83553f3bbf3bd404659e9d5bbf6f19f62e849839820c73154f2c871fec9ed26d

SHA512
37b59ef2eadedee2f3f0bb0a96e1a47d5716a6ef94446c0108eef53e3fd0e4308ef5d704d70d7a05396ee119cbb4bdfe4ddd7636e015fcb59b6631541d4a0a25

Download Submit
memory/856-1-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/856-2-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/856-0-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/856-3-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/856-16-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/856-13-0x0000000001F30000-0x0000000001F3D000-memory.dmp

Filesize
52KB

Download
memory/2700-25-0x0000000001C00000-0x0000000001C06000-memory.dmp

Filesize
24KB

Download
memory/2700-18-0x0000000001C20000-0x0000000001C26000-memory.dmp

Filesize
24KB

Download
memory/2700-26-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download