1c2f0cbaa1150d7c632df35c1918457a1b00ed36df10d66f773b5f7cfbd08c37

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
22/08/2023, 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7178d5903dd8f44faeed8f3ff55cf36f_cryptolocker_JC.exe
Size

26KB
MD5

7178d5903dd8f44faeed8f3ff55cf36f
SHA1

40036489bafd9abb4e8ecf6bbd550389372f3201
SHA256

1c2f0cbaa1150d7c632df35c1918457a1b00ed36df10d66f773b5f7cfbd08c37
SHA512

60bccbcbbcd9ab29a7eb2a3bf46319bdd19c0610a590e726a83d489d084cbe97e422b241c53ae8bfb5d1f4f8d834e30b9de51b5e76239782a97c785b95301382
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUqm:bA74zYcgT/Ekd0ryfjY

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2848	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2780	7178d5903dd8f44faeed8f3ff55cf36f_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2848	2780	7178d5903dd8f44faeed8f3ff55cf36f_cryptolocker_JC.exe	28
PID 2780 wrote to memory of 2848	2780	7178d5903dd8f44faeed8f3ff55cf36f_cryptolocker_JC.exe	28
PID 2780 wrote to memory of 2848	2780	7178d5903dd8f44faeed8f3ff55cf36f_cryptolocker_JC.exe	28
PID 2780 wrote to memory of 2848	2780	7178d5903dd8f44faeed8f3ff55cf36f_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\7178d5903dd8f44faeed8f3ff55cf36f_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\7178d5903dd8f44faeed8f3ff55cf36f_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
26KB

MD5
56e88d28c8ec00aa65e5ce2f72bd23a6

SHA1
17648a5c10e94bc97e029b948d1d0dff264d96a4

SHA256
c094b17017ff8c96466df4f4ad609400c5da884f285199e03036578f6ef490e8

SHA512
db35a602dd41eb0e3c5bebc00a008bc5ac4a965eca3496d33eb0368dcc202ca03e4672312680d4ee7e9c42f6512f0a8833745709935a314bcfdb17dad6e38e14

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
26KB

MD5
56e88d28c8ec00aa65e5ce2f72bd23a6

SHA1
17648a5c10e94bc97e029b948d1d0dff264d96a4

SHA256
c094b17017ff8c96466df4f4ad609400c5da884f285199e03036578f6ef490e8

SHA512
db35a602dd41eb0e3c5bebc00a008bc5ac4a965eca3496d33eb0368dcc202ca03e4672312680d4ee7e9c42f6512f0a8833745709935a314bcfdb17dad6e38e14

Download Submit
\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
26KB

MD5
56e88d28c8ec00aa65e5ce2f72bd23a6

SHA1
17648a5c10e94bc97e029b948d1d0dff264d96a4

SHA256
c094b17017ff8c96466df4f4ad609400c5da884f285199e03036578f6ef490e8

SHA512
db35a602dd41eb0e3c5bebc00a008bc5ac4a965eca3496d33eb0368dcc202ca03e4672312680d4ee7e9c42f6512f0a8833745709935a314bcfdb17dad6e38e14

Download Submit
memory/2780-53-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2780-54-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2780-55-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2848-68-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/2848-69-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download