14e038890029924b43bddcc129cf8f0c2a5e890866a3fd9b9eb4260a4b41afa0

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-05-30_171916fc5db94e784fce41806b021434_cryptolocker.exe
Size

37KB
MD5

171916fc5db94e784fce41806b021434
SHA1

4615adbd231e16849a4f729782da0158f39390e7
SHA256

14e038890029924b43bddcc129cf8f0c2a5e890866a3fd9b9eb4260a4b41afa0
SHA512

eb18f57e50e84134ff22b38884b09cb19e014d7434f35cb1966c8e5b59f0f2a819389ed1bfe47603e4bc2862653f293c1e5248b747b1eaf1ea4a279cd208a6a9
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUgIunexRlSrxV1PVGT:bA74zYcgT/Ekd0ryfjPIunYwfPV4

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000f00000001227e-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
3044	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2116	2024-05-30_171916fc5db94e784fce41806b021434_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 3044	2116	2024-05-30_171916fc5db94e784fce41806b021434_cryptolocker.exe	28
PID 2116 wrote to memory of 3044	2116	2024-05-30_171916fc5db94e784fce41806b021434_cryptolocker.exe	28
PID 2116 wrote to memory of 3044	2116	2024-05-30_171916fc5db94e784fce41806b021434_cryptolocker.exe	28
PID 2116 wrote to memory of 3044	2116	2024-05-30_171916fc5db94e784fce41806b021434_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-30_171916fc5db94e784fce41806b021434_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-30_171916fc5db94e784fce41806b021434_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
37KB

MD5
1a8975d748a62927f1d5dcb33c830d76

SHA1
36db1d30f168b9b9df59859d06bbcd09e8e42bc1

SHA256
4c33f9b4976f3de45738136950ce4765b77ac62897a792eb787800adc321f79b

SHA512
7470a16693b7e608f235afdd8c6942c78653141ea0477b1b317ed4db012f07ea531696535c87d9d6ebe525e750138211c33c1a35b7af45fd7b0d04bf5614dfa3

Download Submit
memory/2116-0-0x0000000001CE0000-0x0000000001CE6000-memory.dmp

Filesize
24KB

Download
memory/2116-8-0x0000000001CE0000-0x0000000001CE6000-memory.dmp

Filesize
24KB

Download
memory/2116-1-0x0000000001CF0000-0x0000000001CF6000-memory.dmp

Filesize
24KB

Download
memory/3044-15-0x0000000001CB0000-0x0000000001CB6000-memory.dmp

Filesize
24KB

Download
memory/3044-22-0x0000000001CA0000-0x0000000001CA6000-memory.dmp

Filesize
24KB

Download