f9077c9cadb92c0a9164379460e5d6f5a920eca2ba286e285a8550ca0cf36b18

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-11_d9cd163caadcffcef5add9d33dcb3db2_cryptolocker.exe
Size

34KB
MD5

d9cd163caadcffcef5add9d33dcb3db2
SHA1

3bee1b28095ec78962463460faa772bec83afc68
SHA256

f9077c9cadb92c0a9164379460e5d6f5a920eca2ba286e285a8550ca0cf36b18
SHA512

f16d569d29b48400954c5b21bf1f6af15c83b402bf1dd4cef06664ee0c784a113779dba5a57ef3b839d5a07749a5e0cc3a60b9b86d24f54c7b5cf9f452fa9a0d
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUgIunIVpeNs23mAA66KT20:bA74zYcgT/Ekd0ryfjPIunqpeNswm90

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2788	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2884	2024-01-11_d9cd163caadcffcef5add9d33dcb3db2_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2788	2884	2024-01-11_d9cd163caadcffcef5add9d33dcb3db2_cryptolocker.exe	28
PID 2884 wrote to memory of 2788	2884	2024-01-11_d9cd163caadcffcef5add9d33dcb3db2_cryptolocker.exe	28
PID 2884 wrote to memory of 2788	2884	2024-01-11_d9cd163caadcffcef5add9d33dcb3db2_cryptolocker.exe	28
PID 2884 wrote to memory of 2788	2884	2024-01-11_d9cd163caadcffcef5add9d33dcb3db2_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-11_d9cd163caadcffcef5add9d33dcb3db2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-11_d9cd163caadcffcef5add9d33dcb3db2_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
34KB

MD5
fa19dea9455c0ac66b12da79864ec7dc

SHA1
063676d1a59dc2bfd911d7ef912c513e41770ef2

SHA256
b1130aa9c183625215ec7cd34500e4de4f2ad2a13d42e35e0bb2509d1eb79696

SHA512
f3e0731686efde33fb1e4ee75831128a676ee306cf6f04955e013dfce49c9b0190bed4c3495aed3bb8f03513897fc4ea246e6fdbad4441a94c82e7d59f1853f8

Download Submit
memory/2788-16-0x00000000003A0000-0x00000000003A6000-memory.dmp

Filesize
24KB

Download
memory/2788-15-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2884-0-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/2884-2-0x0000000000410000-0x0000000000416000-memory.dmp

Filesize
24KB

Download
memory/2884-1-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download