e6c4c3d9b1c62f40e1264d0c21e0d363efbe529cb012692cdab0fce70295bd0b

Analysis

max time kernel
151s
max time network
158s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
27/08/2023, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b134d9a062f1e89c77ef5b9b72c8c61c_cryptolocker_JC.exe
Size

39KB
MD5

b134d9a062f1e89c77ef5b9b72c8c61c
SHA1

e65644025f31ad27db3daa6614b0d9e486b91e01
SHA256

e6c4c3d9b1c62f40e1264d0c21e0d363efbe529cb012692cdab0fce70295bd0b
SHA512

2b2b9cfa519cb350db198ac8107660ae95a2b1c40ed8429d8028c68efce4d5f28aa135cc9ae884f8418b926aec74c3be155e69e7d3c90b769595b92b1cd6b3ba
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf6XT+72kmGYjlQxIxD:bgX4zYcgTEu6QOaryfjqDlC7rYZQKV

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2288	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2252	b134d9a062f1e89c77ef5b9b72c8c61c_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2288	2252	b134d9a062f1e89c77ef5b9b72c8c61c_cryptolocker_JC.exe	28
PID 2252 wrote to memory of 2288	2252	b134d9a062f1e89c77ef5b9b72c8c61c_cryptolocker_JC.exe	28
PID 2252 wrote to memory of 2288	2252	b134d9a062f1e89c77ef5b9b72c8c61c_cryptolocker_JC.exe	28
PID 2252 wrote to memory of 2288	2252	b134d9a062f1e89c77ef5b9b72c8c61c_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\b134d9a062f1e89c77ef5b9b72c8c61c_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\b134d9a062f1e89c77ef5b9b72c8c61c_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
40KB

MD5
0bb8f6656d52ecf95e49245e04155940

SHA1
a293300f688f377e6b61ffb3b765003c0341332a

SHA256
99ee886bd86e03e4f569b961b3e3897e43e360450acbfad5e07779b6a1d01662

SHA512
0bdff695c7a03e36737e9d341d3631a5adb6cb0a91fc8e6a06116db4d8aa3fba004f92f84c0f3971b7d71b773463054b7b2eace5fe28fc23a5dcd8592fc5b071

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
40KB

MD5
0bb8f6656d52ecf95e49245e04155940

SHA1
a293300f688f377e6b61ffb3b765003c0341332a

SHA256
99ee886bd86e03e4f569b961b3e3897e43e360450acbfad5e07779b6a1d01662

SHA512
0bdff695c7a03e36737e9d341d3631a5adb6cb0a91fc8e6a06116db4d8aa3fba004f92f84c0f3971b7d71b773463054b7b2eace5fe28fc23a5dcd8592fc5b071

Download Submit
\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
40KB

MD5
0bb8f6656d52ecf95e49245e04155940

SHA1
a293300f688f377e6b61ffb3b765003c0341332a

SHA256
99ee886bd86e03e4f569b961b3e3897e43e360450acbfad5e07779b6a1d01662

SHA512
0bdff695c7a03e36737e9d341d3631a5adb6cb0a91fc8e6a06116db4d8aa3fba004f92f84c0f3971b7d71b773463054b7b2eace5fe28fc23a5dcd8592fc5b071

Download Submit
memory/2252-0-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2252-1-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download
memory/2252-2-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2288-16-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/2288-15-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download