c298cf38dabc3b41fbbe631cebea0031970589345a7e20b04b9e03aef63fb508

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
27/08/2023, 13:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a864df248cbef69fa0f1e61b37d6681d_cryptolocker_JC.exe
Size

32KB
MD5

a864df248cbef69fa0f1e61b37d6681d
SHA1

b2e3bb6ff8b78f51ac24103e97453c9fb342f10b
SHA256

c298cf38dabc3b41fbbe631cebea0031970589345a7e20b04b9e03aef63fb508
SHA512

ff448cc68c894c7e0b79a98a6b780d72e0156545feb7d823f8decad7b42b733b14b662e1ba461b2270f343bd9c414347586d3f6951aef8f9cf832ea87fffed4e
SSDEEP

384:bgCOR4uGLLQRcsdeQ72ngEUKK7YmE8jI0nrlwfjDU5EFc3RDeqkCi:bgCS4zYcgT/ENr0ryfjG2c3Ni

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4812	hasfj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 4812	2804	a864df248cbef69fa0f1e61b37d6681d_cryptolocker_JC.exe	82
PID 2804 wrote to memory of 4812	2804	a864df248cbef69fa0f1e61b37d6681d_cryptolocker_JC.exe	82
PID 2804 wrote to memory of 4812	2804	a864df248cbef69fa0f1e61b37d6681d_cryptolocker_JC.exe	82

C:\Users\Admin\AppData\Local\Temp\a864df248cbef69fa0f1e61b37d6681d_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\a864df248cbef69fa0f1e61b37d6681d_cryptolocker_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:4812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
33KB

MD5
9b891d5f215136cb3f8cf2c565a30285

SHA1
d3737763083bbadd2e875c67f829b3a89a90ba4d

SHA256
ff086636db2a3a4c4141ac09f47a4c40c210961db3cd8f52be9f97ac4af0bcee

SHA512
4157b1c53cae1b9bd5d0a2f28d2914c0ea440dbddf793377d86c9d819fb9638c1232fe9c4b6333a883722d4a251cf4b2275a5537fa0208ffb13003c59a85f353

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
33KB

MD5
9b891d5f215136cb3f8cf2c565a30285

SHA1
d3737763083bbadd2e875c67f829b3a89a90ba4d

SHA256
ff086636db2a3a4c4141ac09f47a4c40c210961db3cd8f52be9f97ac4af0bcee

SHA512
4157b1c53cae1b9bd5d0a2f28d2914c0ea440dbddf793377d86c9d819fb9638c1232fe9c4b6333a883722d4a251cf4b2275a5537fa0208ffb13003c59a85f353

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
33KB

MD5
9b891d5f215136cb3f8cf2c565a30285

SHA1
d3737763083bbadd2e875c67f829b3a89a90ba4d

SHA256
ff086636db2a3a4c4141ac09f47a4c40c210961db3cd8f52be9f97ac4af0bcee

SHA512
4157b1c53cae1b9bd5d0a2f28d2914c0ea440dbddf793377d86c9d819fb9638c1232fe9c4b6333a883722d4a251cf4b2275a5537fa0208ffb13003c59a85f353

Download Submit
memory/2804-0-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/2804-1-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/2804-2-0x0000000002400000-0x0000000002406000-memory.dmp

Filesize
24KB

Download
memory/4812-17-0x0000000003010000-0x0000000003016000-memory.dmp

Filesize
24KB

Download
memory/4812-18-0x0000000002250000-0x0000000002256000-memory.dmp

Filesize
24KB

Download