581373f6810e2e61b691def114bee22233cfb15151ca185e6cfec345d4a74e76

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
04-08-2023 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f66e4638f74a06f8003d591fa62278f_cryptolocker_JC.exe
Size

26KB
MD5

5f66e4638f74a06f8003d591fa62278f
SHA1

11b10dbd6d145395ef5bed4bb353202d44ab49be
SHA256

581373f6810e2e61b691def114bee22233cfb15151ca185e6cfec345d4a74e76
SHA512

ce8512d0f95d85eecb1d32e12f8b615bfc3f4f45285e50d8b08b205a0f3b531e12c991dcbed1402660a2562b29d758ee2cfc23baff0bacc298492626c39a60d2
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUa2s:bgX4zYcgTEu6QOaryfjnP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2072	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2132	5f66e4638f74a06f8003d591fa62278f_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2072	2132	5f66e4638f74a06f8003d591fa62278f_cryptolocker_JC.exe	28
PID 2132 wrote to memory of 2072	2132	5f66e4638f74a06f8003d591fa62278f_cryptolocker_JC.exe	28
PID 2132 wrote to memory of 2072	2132	5f66e4638f74a06f8003d591fa62278f_cryptolocker_JC.exe	28
PID 2132 wrote to memory of 2072	2132	5f66e4638f74a06f8003d591fa62278f_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\5f66e4638f74a06f8003d591fa62278f_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\5f66e4638f74a06f8003d591fa62278f_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
26KB

MD5
a87e9bc93b21e63a04c90c1a98ca71e9

SHA1
b6fba8bb94a02ecf4bd67f473e2e188af3f49dfe

SHA256
f2f7223ac96979756df39666441f013859a4e59549f1f3d7e6c9172c8a0db5c2

SHA512
575598ba7336e40fdcf53920b27e75b2f9288e72289a1993f705994bb7eca187a246135477865ba1b66dc2ee26ef4267a91cf339695419ab438968f28fcaf9e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
26KB

MD5
a87e9bc93b21e63a04c90c1a98ca71e9

SHA1
b6fba8bb94a02ecf4bd67f473e2e188af3f49dfe

SHA256
f2f7223ac96979756df39666441f013859a4e59549f1f3d7e6c9172c8a0db5c2

SHA512
575598ba7336e40fdcf53920b27e75b2f9288e72289a1993f705994bb7eca187a246135477865ba1b66dc2ee26ef4267a91cf339695419ab438968f28fcaf9e6

Download Submit
\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
26KB

MD5
a87e9bc93b21e63a04c90c1a98ca71e9

SHA1
b6fba8bb94a02ecf4bd67f473e2e188af3f49dfe

SHA256
f2f7223ac96979756df39666441f013859a4e59549f1f3d7e6c9172c8a0db5c2

SHA512
575598ba7336e40fdcf53920b27e75b2f9288e72289a1993f705994bb7eca187a246135477865ba1b66dc2ee26ef4267a91cf339695419ab438968f28fcaf9e6

Download Submit
memory/2072-70-0x0000000001CA0000-0x0000000001CA6000-memory.dmp

Filesize
24KB

Download
memory/2072-69-0x0000000000550000-0x0000000000556000-memory.dmp

Filesize
24KB

Download
memory/2132-54-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2132-56-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2132-55-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download