Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    09/06/2024, 07:34

General

  • Target

    2024-06-09_b2e65c6612e492dd5a6dde83c8bcc69d_cryptolocker.exe

  • Size

    43KB

  • MD5

    b2e65c6612e492dd5a6dde83c8bcc69d

  • SHA1

    26daaf9dfcb3dbf107df4b4f108231a2790f4b5e

  • SHA256

    58a72dbd3104b672f2d0d2f4ea941a9eb5a9edd695b987058e71a62cf10f6777

  • SHA512

    5f3318d102262a19b3822361bf92875c1e841c4ab9d9bd06e14242488c73561318d96a48b787a550fdf86d9624047e557c191b5af5845513ce1af8fca4200471

  • SSDEEP

    384:bm74uGLLQRcsdeQ72ngEr4K7YmE8jb0nrlwfjDUkP:bm74zYcgT/EkM0ryfjdP

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-09_b2e65c6612e492dd5a6dde83c8bcc69d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-09_b2e65c6612e492dd5a6dde83c8bcc69d_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:836
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:2356

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    43KB

    MD5

    7d06580faa717ce35a4ee67fd30f608b

    SHA1

    d9331245195b818c6d71768d132c961be98ea3d8

    SHA256

    61ee492bb71ed3357a9edc92fa7941d9c419969d122ecd88210bc3bd159055d2

    SHA512

    8c0f257a46003eafbada48d8b2ffbfc120f1858d5e8d1f845ca1c8a6722bb61ed987cd8327afcb7d72b8ad32b8ca644372b2809d08ef27cba8ce5343940525f2

  • memory/836-0-0x0000000008000000-0x000000000800D000-memory.dmp

    Filesize

    52KB

  • memory/836-1-0x0000000000570000-0x0000000000576000-memory.dmp

    Filesize

    24KB

  • memory/836-2-0x0000000001CF0000-0x0000000001CF6000-memory.dmp

    Filesize

    24KB

  • memory/836-9-0x0000000000570000-0x0000000000576000-memory.dmp

    Filesize

    24KB

  • memory/836-15-0x0000000008000000-0x000000000800D000-memory.dmp

    Filesize

    52KB

  • memory/2356-16-0x0000000008000000-0x000000000800D000-memory.dmp

    Filesize

    52KB

  • memory/2356-18-0x0000000000500000-0x0000000000506000-memory.dmp

    Filesize

    24KB

  • memory/2356-25-0x00000000004F0000-0x00000000004F6000-memory.dmp

    Filesize

    24KB

  • memory/2356-26-0x0000000008000000-0x000000000800D000-memory.dmp

    Filesize

    52KB