2a415613df340c7ef26b9091321d1447a1d5433fc86cbf076ed3896c475f392f

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
25-08-2023 16:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d8fa20daece850e0c888d4b3990feb7_cryptolocker_JC.exe
Size

37KB
MD5

9d8fa20daece850e0c888d4b3990feb7
SHA1

d736ede1d2f29c7e5e66e073606b32f71cafe6a0
SHA256

2a415613df340c7ef26b9091321d1447a1d5433fc86cbf076ed3896c475f392f
SHA512

99397efbd1dd40206b087432646d029dec229d75ce5c5cb748aa25263d270125f789e9cd455ed3b699d6ce6c67b389d36cdd7a4540daa14df5b444570dbd833f
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf6XT+0vJsghbZ/++RNzU:bgX4zYcgTEu6QOaryfjqDlC6JtbZ/Pf0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2376	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
1700	9d8fa20daece850e0c888d4b3990feb7_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2376	1700	9d8fa20daece850e0c888d4b3990feb7_cryptolocker_JC.exe	28
PID 1700 wrote to memory of 2376	1700	9d8fa20daece850e0c888d4b3990feb7_cryptolocker_JC.exe	28
PID 1700 wrote to memory of 2376	1700	9d8fa20daece850e0c888d4b3990feb7_cryptolocker_JC.exe	28
PID 1700 wrote to memory of 2376	1700	9d8fa20daece850e0c888d4b3990feb7_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\9d8fa20daece850e0c888d4b3990feb7_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\9d8fa20daece850e0c888d4b3990feb7_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
37KB

MD5
1cd332c7542eb43900d3289131b1d45a

SHA1
ef9bafc2165dc0dffc9328f369674afd6f5eb008

SHA256
fb460fc1a011824a31686b257b233f65759acacb2a9e3b15ed3a3cd832ae65b8

SHA512
9889a5a86b0f2a34e91dfb981f1dd456c47662f2f31ff935f9d16f6b0ef45c685b92b513b0d6033b4c30336dcfa112be87a1359d36052d2952c1340471b07095

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
37KB

MD5
1cd332c7542eb43900d3289131b1d45a

SHA1
ef9bafc2165dc0dffc9328f369674afd6f5eb008

SHA256
fb460fc1a011824a31686b257b233f65759acacb2a9e3b15ed3a3cd832ae65b8

SHA512
9889a5a86b0f2a34e91dfb981f1dd456c47662f2f31ff935f9d16f6b0ef45c685b92b513b0d6033b4c30336dcfa112be87a1359d36052d2952c1340471b07095

Download Submit
\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
37KB

MD5
1cd332c7542eb43900d3289131b1d45a

SHA1
ef9bafc2165dc0dffc9328f369674afd6f5eb008

SHA256
fb460fc1a011824a31686b257b233f65759acacb2a9e3b15ed3a3cd832ae65b8

SHA512
9889a5a86b0f2a34e91dfb981f1dd456c47662f2f31ff935f9d16f6b0ef45c685b92b513b0d6033b4c30336dcfa112be87a1359d36052d2952c1340471b07095

Download Submit
memory/1700-0-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1700-1-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1700-2-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/2376-16-0x0000000000570000-0x0000000000576000-memory.dmp

Filesize
24KB

Download
memory/2376-15-0x0000000000550000-0x0000000000556000-memory.dmp

Filesize
24KB

Download