2996c6be7cb1ee46b08e8ebc977bf1053f4b839dcaee0e590ae0e1dd0ee77c49

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-10_d160f249a0bc3fa180bd974c567fcc01_cryptolocker.exe
Size

38KB
MD5

d160f249a0bc3fa180bd974c567fcc01
SHA1

0cedddc933a7e09caf8d13b624f3282ddac77c21
SHA256

2996c6be7cb1ee46b08e8ebc977bf1053f4b839dcaee0e590ae0e1dd0ee77c49
SHA512

48ef1fa4866407df3e687a60f4c4337503a0ae5f37f07dd02412c80c7271e246ee81f724bc430c5b644c23b5aad45bf495a0ea423ff04f408a2c96cc751ab9da
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf0w3sp8u5cZ95d9hV8:bgX4zYcgTEu6QOaryfjqDDw3sCu529hS

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2716	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2392	2024-01-10_d160f249a0bc3fa180bd974c567fcc01_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2716	2392	2024-01-10_d160f249a0bc3fa180bd974c567fcc01_cryptolocker.exe	16
PID 2392 wrote to memory of 2716	2392	2024-01-10_d160f249a0bc3fa180bd974c567fcc01_cryptolocker.exe	16
PID 2392 wrote to memory of 2716	2392	2024-01-10_d160f249a0bc3fa180bd974c567fcc01_cryptolocker.exe	16
PID 2392 wrote to memory of 2716	2392	2024-01-10_d160f249a0bc3fa180bd974c567fcc01_cryptolocker.exe	16

C:\Users\Admin\AppData\Local\Temp\2024-01-10_d160f249a0bc3fa180bd974c567fcc01_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-10_d160f249a0bc3fa180bd974c567fcc01_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
2KB

MD5
80fff9554cf1e05f614821603e482eb5

SHA1
6921bd25702946ac817a49dbaeecdef700c38b30

SHA256
cbaf8a5fa71e70b0943d77cd4b41108bf92fdaf3ff57b35ad1ce93f81c599c8e

SHA512
accf91a76050bc1814eda1bfd0dab538b6aaef2278f96c90bbbdb2152306587074f1e330e66cc41f96c1080ff4c0a3a539329721ace9ab498a6368aae6c548d5

Download Submit
\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
31KB

MD5
346a2b64380cfae30361df2f0bb6adeb

SHA1
20c4a0905bbcecc2f893345ba59e2215f76d6bcb

SHA256
377908164782362ee679eeb21c9cc80022b9306e274046eaea1111d2e6c1c26d

SHA512
c092e4aec1ca136400d84128e3dd599e3b37a91dcdd2c8a719c5f6b2b16fb13748ac88d643b61aac771b148320f6c1d919a66a85a84115315835cc2420955679

Download Submit
memory/2392-0-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2392-8-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2392-1-0x0000000000410000-0x0000000000416000-memory.dmp

Filesize
24KB

Download
memory/2716-15-0x0000000000570000-0x0000000000576000-memory.dmp

Filesize
24KB

Download
memory/2716-18-0x0000000000550000-0x0000000000556000-memory.dmp

Filesize
24KB

Download