Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/06/2024, 00:28

General

  • Target

    2024-06-29_209883c88a13518a751c79a79fcf41cf_cryptolocker.exe

  • Size

    35KB

  • MD5

    209883c88a13518a751c79a79fcf41cf

  • SHA1

    c11bd270735d4bd33742829bb33955467f6361a5

  • SHA256

    9217d2287e0c4b15be3692596570a15cfbd0c9a56a3f49f455d5b7a61b7f00dd

  • SHA512

    f539900998cb0a9ecc606f404c96104bc09d3f58d5c2d40b7e95cc1be1a9df335de58db7baf161549fb56c1a9f547fa820dbb39268eccebfa6c8314724c7e685

  • SSDEEP

    384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUGTGXvJF3SQ:bG74zYcgT/Ekd0ryfjkbCQ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-29_209883c88a13518a751c79a79fcf41cf_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-29_209883c88a13518a751c79a79fcf41cf_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1740
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:2576

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    35KB

    MD5

    845a0be137830caf0d4e1b879ea10809

    SHA1

    6a81129e38f6823d259352ca7369f9756e8d76e7

    SHA256

    d7d755e19559a63f431f174c9bb2a39944cbdee83fb6d8c568d16feb3b1dea37

    SHA512

    645c8bd37b44f56f8097868e0dec0a7a5ddcf1841ea4dba9b307e5191493848aa285e7f8c9abf8471df83a80ddb7a9780631796a957dc988f5a55f9f7ee627c2

  • memory/1740-0-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/1740-9-0x0000000000810000-0x0000000000816000-memory.dmp

    Filesize

    24KB

  • memory/1740-2-0x0000000000820000-0x0000000000826000-memory.dmp

    Filesize

    24KB

  • memory/1740-1-0x0000000000810000-0x0000000000816000-memory.dmp

    Filesize

    24KB

  • memory/1740-15-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/2576-16-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB

  • memory/2576-18-0x0000000000490000-0x0000000000496000-memory.dmp

    Filesize

    24KB

  • memory/2576-25-0x0000000000480000-0x0000000000486000-memory.dmp

    Filesize

    24KB

  • memory/2576-26-0x0000000008000000-0x000000000800A000-memory.dmp

    Filesize

    40KB