ac24ef111464615583f608b1dc0b8e8810d0ca7474acbefa0f2ed927ccc0fe20

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 15:51

Target

2024-01-25_d4c8718e9141a225c4924a133004b83f_cryptolocker.exe
Size

39KB
MD5

d4c8718e9141a225c4924a133004b83f
SHA1

be12a7dbfdaa8bc4470b9d6d639e88cd21e3a071
SHA256

ac24ef111464615583f608b1dc0b8e8810d0ca7474acbefa0f2ed927ccc0fe20
SHA512

01a440e0a4abda0d1bdc7424ba1dc4b325b995ee25f7ca87a9646b791b5f2450a2e6d34d16a42e9493046bb001ce21a8de7cfe3c27ac3d375d5b8f1f9b86b1ff
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDDw3sCu5b+rc5vrN:bgGYcA/53GADw8Clrcv

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

3028 hasfj.exe
Loads dropped DLL 1 IoCs

Processes:

2024-01-25_d4c8718e9141a225c4924a133004b83f_cryptolocker.exe

pid process

1108 2024-01-25_d4c8718e9141a225c4924a133004b83f_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3028	hasfj.exe

pid	process
1108	2024-01-25_d4c8718e9141a225c4924a133004b83f_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-01-25_d4c8718e9141a225c4924a133004b83f_cryptolocker.exe

description	pid	process	target process
PID 1108 wrote to memory of 3028	1108	2024-01-25_d4c8718e9141a225c4924a133004b83f_cryptolocker.exe	hasfj.exe
PID 1108 wrote to memory of 3028	1108	2024-01-25_d4c8718e9141a225c4924a133004b83f_cryptolocker.exe	hasfj.exe
PID 1108 wrote to memory of 3028	1108	2024-01-25_d4c8718e9141a225c4924a133004b83f_cryptolocker.exe	hasfj.exe
PID 1108 wrote to memory of 3028	1108	2024-01-25_d4c8718e9141a225c4924a133004b83f_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:3028

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\hasfj.exe
Filesize
39KB

MD5
0607e404bf9b36482075c24e06f6dbf3

SHA1
e1c06555302bae5562ebe96cec4505e5d3ae2ddf

SHA256
3c3082e5c1303a144ed83a802d28bb040d5705e9c6f47525c2a5a102369b76f1

SHA512
4b46ebaa3eb14af24ed9960c374b9e3aec8d66f52efb1d8294c5b726ae55a81f4d5c5681897c5409be54d5d65bb15517eb336a2ef30bcac97cd55fce912c7851

Download Submit
memory/1108-0-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/1108-2-0x0000000000500000-0x0000000000506000-memory.dmp

Filesize
24KB

Download
memory/1108-1-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/3028-15-0x0000000001CE0000-0x0000000001CE6000-memory.dmp

Filesize
24KB

Download
memory/3028-16-0x0000000001CF0000-0x0000000001CF6000-memory.dmp

Filesize
24KB

Download