46fe0aa2e6c2d9054c0826df0ea22cfc6674ff7b2cac8f6d9ab2dc0b51be80b0

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2023, 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37673725f246a1087c1d2b406eedd899_cryptolocker_JC.exe
Size

32KB
MD5

37673725f246a1087c1d2b406eedd899
SHA1

89568421abad15e997c9d97e13748db08bea05f8
SHA256

46fe0aa2e6c2d9054c0826df0ea22cfc6674ff7b2cac8f6d9ab2dc0b51be80b0
SHA512

25152b198b939a5b649e079ad965374f3d8a87be7ba22fb21a74d2d8e78dd00a154e139571e0d93267010ea15c7ec78227281bd9b67ea9a45ca38b0bb1ef07d7
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf0w3sp8kE/cm:bgX4zYcgTEu6QOaryfjqDDw3sCMm

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5028	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 5028	3844	37673725f246a1087c1d2b406eedd899_cryptolocker_JC.exe	86
PID 3844 wrote to memory of 5028	3844	37673725f246a1087c1d2b406eedd899_cryptolocker_JC.exe	86
PID 3844 wrote to memory of 5028	3844	37673725f246a1087c1d2b406eedd899_cryptolocker_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\37673725f246a1087c1d2b406eedd899_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\37673725f246a1087c1d2b406eedd899_cryptolocker_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:5028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
33KB

MD5
3e212ad64cded4a7a9d87cf2b98cd24b

SHA1
761adc7bef2e7467ccd6c136c815db26bc73c9bc

SHA256
3ed385236ea3b38bc3bd141c7b51e584531f0f38f478628d169c28b60f1d67ed

SHA512
1d51aa0dc5b4c69ba48c7b553bb9e50b12b988e2457581b392e107de3a0676bdc3ffc7ad0e28c4482840031c6bfd690891c57a40fb45b7fcbd3929db2ba445dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
33KB

MD5
3e212ad64cded4a7a9d87cf2b98cd24b

SHA1
761adc7bef2e7467ccd6c136c815db26bc73c9bc

SHA256
3ed385236ea3b38bc3bd141c7b51e584531f0f38f478628d169c28b60f1d67ed

SHA512
1d51aa0dc5b4c69ba48c7b553bb9e50b12b988e2457581b392e107de3a0676bdc3ffc7ad0e28c4482840031c6bfd690891c57a40fb45b7fcbd3929db2ba445dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
33KB

MD5
3e212ad64cded4a7a9d87cf2b98cd24b

SHA1
761adc7bef2e7467ccd6c136c815db26bc73c9bc

SHA256
3ed385236ea3b38bc3bd141c7b51e584531f0f38f478628d169c28b60f1d67ed

SHA512
1d51aa0dc5b4c69ba48c7b553bb9e50b12b988e2457581b392e107de3a0676bdc3ffc7ad0e28c4482840031c6bfd690891c57a40fb45b7fcbd3929db2ba445dc

Download Submit
memory/3844-133-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/3844-134-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/3844-135-0x0000000002400000-0x0000000002406000-memory.dmp

Filesize
24KB

Download
memory/5028-151-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/5028-150-0x0000000003150000-0x0000000003156000-memory.dmp

Filesize
24KB

Download