e6d3aed6a3736cae8fc9dcf0840027917dadd03af9d53c32b0e3db7c023b9871

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:33

Target

2024-01-25_9b5c4613dc241dfa68ecfa73cc7cf1d3_cryptolocker.exe
Size

46KB
MD5

9b5c4613dc241dfa68ecfa73cc7cf1d3
SHA1

451cdcdf6cc49c744aca1e9ec85838fe08ec606f
SHA256

e6d3aed6a3736cae8fc9dcf0840027917dadd03af9d53c32b0e3db7c023b9871
SHA512

399f1db43a91e46d878c1cb3b8586ec55d6b4a4eeadfeae6680c57070c147a092ee85c1568a32a40380b5c5c2cc9226b5d3f47efd0ca79223909f30c764e69d8
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37YbDu5z/hDJ:bgGYcA/53GAA6y37nbN

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

2384 hasfj.exe
Loads dropped DLL 1 IoCs

Processes:

2024-01-25_9b5c4613dc241dfa68ecfa73cc7cf1d3_cryptolocker.exe

pid process

1992 2024-01-25_9b5c4613dc241dfa68ecfa73cc7cf1d3_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2384	hasfj.exe

pid	process
1992	2024-01-25_9b5c4613dc241dfa68ecfa73cc7cf1d3_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-01-25_9b5c4613dc241dfa68ecfa73cc7cf1d3_cryptolocker.exe

description	pid	process	target process
PID 1992 wrote to memory of 2384	1992	2024-01-25_9b5c4613dc241dfa68ecfa73cc7cf1d3_cryptolocker.exe	hasfj.exe
PID 1992 wrote to memory of 2384	1992	2024-01-25_9b5c4613dc241dfa68ecfa73cc7cf1d3_cryptolocker.exe	hasfj.exe
PID 1992 wrote to memory of 2384	1992	2024-01-25_9b5c4613dc241dfa68ecfa73cc7cf1d3_cryptolocker.exe	hasfj.exe
PID 1992 wrote to memory of 2384	1992	2024-01-25_9b5c4613dc241dfa68ecfa73cc7cf1d3_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:2384

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\hasfj.exe
Filesize
46KB

MD5
585ecf172e8b9efac582e4732d0911da

SHA1
b3db62eecb985b0af6e5250dbf8e0d61e8e1cfdb

SHA256
760459c5a2a4f7ec497e6cfda15136d811a66104672690fd0d67f346dcbed6cf

SHA512
1fd88708884dff26982516c608555f316d8ec47320e00905e8a1b2b7458b62c679b1f334601aec5f256ba05dcc7fca03c75921fa23811047b911ff1386a938bc

Download Submit
memory/1992-0-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/1992-1-0x0000000001CB0000-0x0000000001CB6000-memory.dmp

Filesize
24KB

Download
memory/1992-4-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/2384-15-0x0000000001CF0000-0x0000000001CF6000-memory.dmp

Filesize
24KB

Download
memory/2384-22-0x0000000001CE0000-0x0000000001CE6000-memory.dmp

Filesize
24KB

Download