Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 23:09

General

  • Target

    2024-06-02_5b05b179fbc39ae636e3186687ebc46d_cryptolocker.exe

  • Size

    44KB

  • MD5

    5b05b179fbc39ae636e3186687ebc46d

  • SHA1

    77d2d14472fac330abefb13d28a424cd8527fa6e

  • SHA256

    da2292a4414b522ea769a560959d23130b04ffc22e50f8a4f2ad2d766260654f

  • SHA512

    780e269f8f945c2a38c1265520be072b90b6100d7415d0282f2c512448e6fd537fbf2c5af5efc0fc6088c8ef91ce073fc42a71de8bcabcda9ee885a9d73cd010

  • SSDEEP

    384:bm74uGLLQRcsdeQ72ngEr4K7YmE8jb0nrlwfjDUadQC8i:bm74zYcgT/EkM0ryfjPdQZi

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-02_5b05b179fbc39ae636e3186687ebc46d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-02_5b05b179fbc39ae636e3186687ebc46d_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2228
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:2840

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\hasfj.exe

          Filesize

          45KB

          MD5

          e786e06e46b552c28aef133d754dab01

          SHA1

          cd6892debbc8c19ca82687b08dcc977741c83cd7

          SHA256

          68b66e8a4b89b8c9c2f3d1e0bc24134e1776280f61a50a3ec759bf01968cc75e

          SHA512

          7e0c0f0c53c46d202baa7c9608f837cd687a2f3b2e9ee9bf23de15bf6a84e54b40e3d7c5e5e7d4c95f775ae71c8a4874ecde9e820d63f9bcc7a6630020636095

        • memory/2228-0-0x0000000008000000-0x000000000800D000-memory.dmp

          Filesize

          52KB

        • memory/2228-2-0x00000000002B0000-0x00000000002B6000-memory.dmp

          Filesize

          24KB

        • memory/2228-1-0x00000000002A0000-0x00000000002A6000-memory.dmp

          Filesize

          24KB

        • memory/2228-9-0x00000000002A0000-0x00000000002A6000-memory.dmp

          Filesize

          24KB

        • memory/2228-15-0x0000000008000000-0x000000000800D000-memory.dmp

          Filesize

          52KB

        • memory/2840-16-0x0000000008000000-0x000000000800D000-memory.dmp

          Filesize

          52KB

        • memory/2840-25-0x0000000008000000-0x000000000800D000-memory.dmp

          Filesize

          52KB