489a627e0ae8d8e7393f1f6947b9a16ea41b3b90c7388e0ca842a42ab9717afc

Analysis

max time kernel
148s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 05:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-09_a6db6616f12e2f03ea6f7cb6fc5cdd95_cryptolocker.exe
Size

44KB
MD5

a6db6616f12e2f03ea6f7cb6fc5cdd95
SHA1

f05d650f3af17f314b39fa9f806070518d823c69
SHA256

489a627e0ae8d8e7393f1f6947b9a16ea41b3b90c7388e0ca842a42ab9717afc
SHA512

76bd73cc16cb6c6a51ca9ed27e6a1568af3cb3873434746e5e59deff0887158ac5ac568f81379103463dd41051c5f18cac1bac7c43c5417c63ec28e630610c8d
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37YbDu5z/hrJ:bgGYcA/53GAA6y37nbrJ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2692	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2968	2024-01-09_a6db6616f12e2f03ea6f7cb6fc5cdd95_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2692	2968	2024-01-09_a6db6616f12e2f03ea6f7cb6fc5cdd95_cryptolocker.exe	28
PID 2968 wrote to memory of 2692	2968	2024-01-09_a6db6616f12e2f03ea6f7cb6fc5cdd95_cryptolocker.exe	28
PID 2968 wrote to memory of 2692	2968	2024-01-09_a6db6616f12e2f03ea6f7cb6fc5cdd95_cryptolocker.exe	28
PID 2968 wrote to memory of 2692	2968	2024-01-09_a6db6616f12e2f03ea6f7cb6fc5cdd95_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-09_a6db6616f12e2f03ea6f7cb6fc5cdd95_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-09_a6db6616f12e2f03ea6f7cb6fc5cdd95_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
45KB

MD5
167ce8cc24981cfb15db86f74114e154

SHA1
caf9fbe1997366f21f81365253a3d49a4ec22cd7

SHA256
ab8213f6d94d955e015790a62c0f341b8cdbc03ff0e7b41fdf0fff0c3e192a91

SHA512
7d34ece150d2340c4cf51b3a315f0ef9540b3a2645713086680633ce5b69627065e35c23cea8970be51c4b68bb2b7e9499cfd7fb51147fc74a9bb48b718e166f

Download Submit
memory/2692-15-0x00000000004C0000-0x00000000004C6000-memory.dmp

Filesize
24KB

Download
memory/2692-19-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2968-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2968-1-0x00000000002E0000-0x00000000002E6000-memory.dmp

Filesize
24KB

Download
memory/2968-2-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download