08ed544cf3a059544e06db5d0b5b68b5bef3713e5504204422253d59fa9d9d46

Analysis

max time kernel
144s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 04:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-13_540b3f9f83ccc7740281c252e8dd0ea0_cryptolocker.exe
Size

45KB
MD5

540b3f9f83ccc7740281c252e8dd0ea0
SHA1

5d4c1a1571fc46f77d1b6b607b679d301d3de4ea
SHA256

08ed544cf3a059544e06db5d0b5b68b5bef3713e5504204422253d59fa9d9d46
SHA512

b93de79163becef21766f1a6d1f41d0310820937660cf5da016a342995df2762373008b0619b70e141448ff9b91aead63f635e099548208e4d8be34232c56981
SSDEEP

384:bm74uGLLQRcsdeQ72ngEr4K7YmE8jb0nrlwfjDUadQC8o:bm74zYcgT/EkM0ryfjPdQZo

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2104-0-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000b00000001226d-11.dat	CryptoLocker_rule2
behavioral1/memory/1912-16-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2104-14-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1912-26-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
1912	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2104	2024-06-13_540b3f9f83ccc7740281c252e8dd0ea0_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 1912	2104	2024-06-13_540b3f9f83ccc7740281c252e8dd0ea0_cryptolocker.exe	28
PID 2104 wrote to memory of 1912	2104	2024-06-13_540b3f9f83ccc7740281c252e8dd0ea0_cryptolocker.exe	28
PID 2104 wrote to memory of 1912	2104	2024-06-13_540b3f9f83ccc7740281c252e8dd0ea0_cryptolocker.exe	28
PID 2104 wrote to memory of 1912	2104	2024-06-13_540b3f9f83ccc7740281c252e8dd0ea0_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-13_540b3f9f83ccc7740281c252e8dd0ea0_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-13_540b3f9f83ccc7740281c252e8dd0ea0_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
45KB

MD5
8938c60105ded3dd19eea7d8fc63718a

SHA1
ce362653ab9e2b8df22673b05f7eba65fbbbc368

SHA256
b58e2511dc0720755048963a0461b6c1f7f2d10eef3c90e4055f0b9e367cb29f

SHA512
efd22a91ab78804ae55522861b161fb1d862d0339d9c04d271c3f88b11611c5947c7d42c3a9886907dd9454812beba1ab4a6cc15137e2bc64a23c182eecdd1e9

Download Submit
memory/1912-16-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/1912-18-0x0000000001CF0000-0x0000000001CF6000-memory.dmp

Filesize
24KB

Download
memory/1912-25-0x0000000001CE0000-0x0000000001CE6000-memory.dmp

Filesize
24KB

Download
memory/1912-26-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/2104-0-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/2104-1-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2104-2-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2104-9-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2104-14-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download