1e70deee3b75f6bc200831941a4aeb62630c7a2a556102089c86d8e4d8baced5

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-06-03_3ecb0fd92e9665e1a8ad30bdd9cbc2ca_cryptolocker.exe
Size

34KB
MD5

3ecb0fd92e9665e1a8ad30bdd9cbc2ca
SHA1

c5d93d7325ef08ac4c4054fecac1e8d63feec8dc
SHA256

1e70deee3b75f6bc200831941a4aeb62630c7a2a556102089c86d8e4d8baced5
SHA512

33323bd487415c4944d88cb240afdd4983fc9065b5bf8a411a66cf1406a0e70a0ba997375a857018714cf9f5bfa6832b3f715e0f48c0861544c523d6dc9accfb
SSDEEP

384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUGTGLZ9aLzd:bG74zYcgT/Ekd0ryfjgjaV

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2484-0-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c000000013ab9-11.dat	CryptoLocker_rule2
behavioral1/memory/2484-15-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/3024-16-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/3024-26-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
3024	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2484	2024-06-03_3ecb0fd92e9665e1a8ad30bdd9cbc2ca_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 3024	2484	2024-06-03_3ecb0fd92e9665e1a8ad30bdd9cbc2ca_cryptolocker.exe	28
PID 2484 wrote to memory of 3024	2484	2024-06-03_3ecb0fd92e9665e1a8ad30bdd9cbc2ca_cryptolocker.exe	28
PID 2484 wrote to memory of 3024	2484	2024-06-03_3ecb0fd92e9665e1a8ad30bdd9cbc2ca_cryptolocker.exe	28
PID 2484 wrote to memory of 3024	2484	2024-06-03_3ecb0fd92e9665e1a8ad30bdd9cbc2ca_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-03_3ecb0fd92e9665e1a8ad30bdd9cbc2ca_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_3ecb0fd92e9665e1a8ad30bdd9cbc2ca_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
34KB

MD5
88578a071e212b14956fa3343525e743

SHA1
0e2e372e0ec84ba9c7bf95140f315317fb98a7dc

SHA256
eadef01e1f8a9738727d57ca8b7783578ae6bb9e7650b1230d989b85aa986124

SHA512
ea44489cc46834177b1ecedcdd37faee83f3bcd6f8368a62cc1f480c48fd2f6291d0dee08e9d7c38c36adfea658d07e2f7693d9e962b19b6639fe48a160477f4

Download Submit
memory/2484-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2484-1-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2484-2-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2484-9-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2484-15-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/3024-16-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/3024-18-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/3024-25-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/3024-26-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download