Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 04:50
Behavioral task
behavioral1
Sample
2024-06-02_f83e6ecd31e75a62d9d8337045579c97_cryptolocker.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-02_f83e6ecd31e75a62d9d8337045579c97_cryptolocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-02_f83e6ecd31e75a62d9d8337045579c97_cryptolocker.exe
-
Size
24KB
-
MD5
f83e6ecd31e75a62d9d8337045579c97
-
SHA1
ccd788da80e1fb3991ab0d1e9ef0c45f8722e88c
-
SHA256
5f838b4b1e182422b6fd26c45e8b250366fd2a938602f1551d5fbfce131f6094
-
SHA512
d3dfd33203f69904296a98bb4eace63203bf9a15413ad1bd5ef69403146aeb13b3084d7616ad088a044984b817cc185e6956a3019da19ae93d23971d6c42f27d
-
SSDEEP
384:bVCPwFRuFn65arz1ZhdaXFXSCVQTLfjDp6HMJS:bVCPwFRo6CpwXFXSqQXfjAsJS
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
resource yara_rule behavioral1/memory/2936-0-0x0000000008000000-0x000000000800E000-memory.dmp CryptoLocker_rule2 behavioral1/files/0x000e00000001214d-11.dat CryptoLocker_rule2 behavioral1/memory/1720-17-0x0000000008000000-0x000000000800E000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2936-16-0x0000000008000000-0x000000000800E000-memory.dmp CryptoLocker_rule2 behavioral1/memory/1720-27-0x0000000008000000-0x000000000800E000-memory.dmp CryptoLocker_rule2 -
UPX dump on OEP (original entry point) 5 IoCs
resource yara_rule behavioral1/memory/2936-0-0x0000000008000000-0x000000000800E000-memory.dmp UPX behavioral1/files/0x000e00000001214d-11.dat UPX behavioral1/memory/1720-17-0x0000000008000000-0x000000000800E000-memory.dmp UPX behavioral1/memory/2936-16-0x0000000008000000-0x000000000800E000-memory.dmp UPX behavioral1/memory/1720-27-0x0000000008000000-0x000000000800E000-memory.dmp UPX -
Executes dropped EXE 1 IoCs
pid Process 1720 hasfj.exe -
Loads dropped DLL 1 IoCs
pid Process 2936 2024-06-02_f83e6ecd31e75a62d9d8337045579c97_cryptolocker.exe -
resource yara_rule behavioral1/memory/2936-0-0x0000000008000000-0x000000000800E000-memory.dmp upx behavioral1/files/0x000e00000001214d-11.dat upx behavioral1/memory/1720-17-0x0000000008000000-0x000000000800E000-memory.dmp upx behavioral1/memory/2936-16-0x0000000008000000-0x000000000800E000-memory.dmp upx behavioral1/memory/1720-27-0x0000000008000000-0x000000000800E000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2936 wrote to memory of 1720 2936 2024-06-02_f83e6ecd31e75a62d9d8337045579c97_cryptolocker.exe 28 PID 2936 wrote to memory of 1720 2936 2024-06-02_f83e6ecd31e75a62d9d8337045579c97_cryptolocker.exe 28 PID 2936 wrote to memory of 1720 2936 2024-06-02_f83e6ecd31e75a62d9d8337045579c97_cryptolocker.exe 28 PID 2936 wrote to memory of 1720 2936 2024-06-02_f83e6ecd31e75a62d9d8337045579c97_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_f83e6ecd31e75a62d9d8337045579c97_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_f83e6ecd31e75a62d9d8337045579c97_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\hasfj.exe"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"2⤵
- Executes dropped EXE
PID:1720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD54a3defde3c75af9a87a61ff83377cb95
SHA1786532c957f305f0508c40a57ca1167947d23f55
SHA256f465350a7ce0298d4a68a655652dd199bb06f4b3edce8e67244dd5094930a726
SHA5121e95269144a13b468323f8f4d17b6bb60e3d1b1240a7540845fce3cec2615744d256c32f84576fe0507988fb439f65336168e03393ac38eabca6312c23177fcd