b4d7e819ad8f419950f48362b17e9eeca8f924231ba14cf057874745c3eaa243

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18-08-2023 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2504f63384f3dc738c3712d85ffcb8d8_cryptolocker_JC.exe
Size

28KB
MD5

2504f63384f3dc738c3712d85ffcb8d8
SHA1

e14ec3c99184d88958e4b3457b10161df7993e24
SHA256

b4d7e819ad8f419950f48362b17e9eeca8f924231ba14cf057874745c3eaa243
SHA512

58c8a4d09c6e10ace77ae8578c728929ab17029ab6474dad1ac32e6cd98cc12ab5f5aa6a2eb724bdd0594ac2727aebd5e58b7fb7259aa90574d7d22ee11e81cf
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUgIunvs9P:bA74zYcgT/Ekd0ryfjPIunvsd

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2488	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
1996	2504f63384f3dc738c3712d85ffcb8d8_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2488	1996	2504f63384f3dc738c3712d85ffcb8d8_cryptolocker_JC.exe	28
PID 1996 wrote to memory of 2488	1996	2504f63384f3dc738c3712d85ffcb8d8_cryptolocker_JC.exe	28
PID 1996 wrote to memory of 2488	1996	2504f63384f3dc738c3712d85ffcb8d8_cryptolocker_JC.exe	28
PID 1996 wrote to memory of 2488	1996	2504f63384f3dc738c3712d85ffcb8d8_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\2504f63384f3dc738c3712d85ffcb8d8_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2504f63384f3dc738c3712d85ffcb8d8_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
29KB

MD5
8203a8e385f06c181c8167ff7a607b82

SHA1
e0fac8eb3beab13a5ec91d889bca7381a061bb0c

SHA256
c9b384d63ad73e6faa4e9944af03b3ad1a21dfbe5a87a604894f74f66ead0cc2

SHA512
c748b6f12c427665533646dcd76a9d0f092862d9ad6c9c5cd98fd226deb2d85f08eb5967abffcc2f74d3cd8451829af324342b33dfd2d1a4986d68fc5f2e198d

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
29KB

MD5
8203a8e385f06c181c8167ff7a607b82

SHA1
e0fac8eb3beab13a5ec91d889bca7381a061bb0c

SHA256
c9b384d63ad73e6faa4e9944af03b3ad1a21dfbe5a87a604894f74f66ead0cc2

SHA512
c748b6f12c427665533646dcd76a9d0f092862d9ad6c9c5cd98fd226deb2d85f08eb5967abffcc2f74d3cd8451829af324342b33dfd2d1a4986d68fc5f2e198d

Download Submit
\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
29KB

MD5
8203a8e385f06c181c8167ff7a607b82

SHA1
e0fac8eb3beab13a5ec91d889bca7381a061bb0c

SHA256
c9b384d63ad73e6faa4e9944af03b3ad1a21dfbe5a87a604894f74f66ead0cc2

SHA512
c748b6f12c427665533646dcd76a9d0f092862d9ad6c9c5cd98fd226deb2d85f08eb5967abffcc2f74d3cd8451829af324342b33dfd2d1a4986d68fc5f2e198d

Download Submit
memory/1996-53-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/1996-54-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/1996-55-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2488-69-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/2488-68-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download