009c897f31470685d477fcfb8f0e251fb03777259b63f5b0956669c892be6e5b

Analysis

max time kernel
146s
max time network
150s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
08/08/2023, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9f9b3e2b168611f7622e379e6ac1e3b8_cryptolocker_JC.exe
Size

27KB
MD5

9f9b3e2b168611f7622e379e6ac1e3b8
SHA1

bb3304eb7d2f63acd5c1cccc1e0aa1875b332f3b
SHA256

009c897f31470685d477fcfb8f0e251fb03777259b63f5b0956669c892be6e5b
SHA512

bb20da24337529f25a42127a2ec18e40fc6dbf359affc6060e31a26caebdb2da9f20bdceff9294e474ded58adfbd0f77f5399538d0cbe3acffd857b5e0e88485
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUk5y:bgX4zYcgTEu6QOaryfjY

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2956	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
1620	9f9b3e2b168611f7622e379e6ac1e3b8_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2956	1620	9f9b3e2b168611f7622e379e6ac1e3b8_cryptolocker_JC.exe	28
PID 1620 wrote to memory of 2956	1620	9f9b3e2b168611f7622e379e6ac1e3b8_cryptolocker_JC.exe	28
PID 1620 wrote to memory of 2956	1620	9f9b3e2b168611f7622e379e6ac1e3b8_cryptolocker_JC.exe	28
PID 1620 wrote to memory of 2956	1620	9f9b3e2b168611f7622e379e6ac1e3b8_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\9f9b3e2b168611f7622e379e6ac1e3b8_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\9f9b3e2b168611f7622e379e6ac1e3b8_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
27KB

MD5
a9d33035f27ec4ee2af69ce6e124fa5e

SHA1
7c0cf3c2d1bf3308097d53e6a82408f8280b6a7e

SHA256
e2b36ec66a50a17733b1c91227fc1c4c7cf2872161783abbdce17537751db5d4

SHA512
307b24cc24c0b991baa7c6510e8ebf8489b8597e6ccc6bf47914685145f90fe92b14dc4c1bc8b5044d3ba2cb38584619ea0ddb006a2c4b739abe9414802d423d

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
27KB

MD5
a9d33035f27ec4ee2af69ce6e124fa5e

SHA1
7c0cf3c2d1bf3308097d53e6a82408f8280b6a7e

SHA256
e2b36ec66a50a17733b1c91227fc1c4c7cf2872161783abbdce17537751db5d4

SHA512
307b24cc24c0b991baa7c6510e8ebf8489b8597e6ccc6bf47914685145f90fe92b14dc4c1bc8b5044d3ba2cb38584619ea0ddb006a2c4b739abe9414802d423d

Download Submit
\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
27KB

MD5
a9d33035f27ec4ee2af69ce6e124fa5e

SHA1
7c0cf3c2d1bf3308097d53e6a82408f8280b6a7e

SHA256
e2b36ec66a50a17733b1c91227fc1c4c7cf2872161783abbdce17537751db5d4

SHA512
307b24cc24c0b991baa7c6510e8ebf8489b8597e6ccc6bf47914685145f90fe92b14dc4c1bc8b5044d3ba2cb38584619ea0ddb006a2c4b739abe9414802d423d

Download Submit
memory/1620-54-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/1620-55-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/1620-56-0x00000000004C0000-0x00000000004C6000-memory.dmp

Filesize
24KB

Download
memory/2956-69-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2956-70-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download