312b7d67b08560882c7839e30bdc7950d4cb6af628eac78263c6f3292b6371ee

Analysis

max time kernel
149s
max time network
162s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-09_89b126d96bd96a98cd582779e705c6db_cryptolocker.exe
Size

39KB
MD5

89b126d96bd96a98cd582779e705c6db
SHA1

c159533fbcb32ba210d25e8076d4dfa34801f80f
SHA256

312b7d67b08560882c7839e30bdc7950d4cb6af628eac78263c6f3292b6371ee
SHA512

f3c72953046327e72b7ea49c4d4dafed2384b5397768971d67da8ad18b8c09432faa25f2a8a0a68c2287429eb5d9d39791892e7c953749ba1b10244e3f59c836
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf0w3sp8u5cZ95d9hVC:bgX4zYcgTEu6QOaryfjqDDw3sCu529hM

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3012	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2760	2024-01-09_89b126d96bd96a98cd582779e705c6db_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 3012	2760	2024-01-09_89b126d96bd96a98cd582779e705c6db_cryptolocker.exe	28
PID 2760 wrote to memory of 3012	2760	2024-01-09_89b126d96bd96a98cd582779e705c6db_cryptolocker.exe	28
PID 2760 wrote to memory of 3012	2760	2024-01-09_89b126d96bd96a98cd582779e705c6db_cryptolocker.exe	28
PID 2760 wrote to memory of 3012	2760	2024-01-09_89b126d96bd96a98cd582779e705c6db_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-09_89b126d96bd96a98cd582779e705c6db_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-09_89b126d96bd96a98cd582779e705c6db_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
33KB

MD5
15a11d3c79e004ddb9b7b214c208d238

SHA1
e4bfaac91c9e58fd275efda40bb796803a41b3be

SHA256
b12b3597a80c3cf12969fa0fd7e507919147adde814a211f66d2c18256898e0f

SHA512
a70521ce49008c2b28778a8244d39caa1d6fb787d5bf56ad8dbf0a577ddc08b7c586a1ced0d48e946ed573fc44c498f6076f0bcd0be290bda5c4d8856f6dc62d

Download Submit
C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
18KB

MD5
38588763a0e6eb808e0264c94a343470

SHA1
e52da97c075e206a5d11a780cb83ffb042d9575c

SHA256
9c5249c181ff6377821655316b3c5a7fcd4b39a5e5577d48604b992c778e2081

SHA512
410ddf53937fa7cb758bb3aef78904316d34e76486d39dcec74b887d0b85134817d652d4b40f4e08ae340d5ffd68532b8e16263f0623ef22fe40abd5c09b1109

Download Submit
\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
39KB

MD5
0d177c0647c73772b72724e50212b709

SHA1
cd43980c704eee9733281c6fc6e06e40ba9d26bf

SHA256
2ee9c7e21f73cf9de3d6e5540549f0f653315ce921c88f216198d60f86b90f42

SHA512
100c78401a617303063b9936d39f20390d616a2bed97dec6d3b02e9b74a4b08f583789f442e749638c00114da42cce643db81368c4339f9f1ae97df88bb4c6e9

Download Submit
memory/2760-2-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2760-1-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2760-0-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/3012-22-0x0000000001C80000-0x0000000001C86000-memory.dmp

Filesize
24KB

Download
memory/3012-15-0x0000000001CA0000-0x0000000001CA6000-memory.dmp

Filesize
24KB

Download