8de82a43b453a7693ce12e2852a9834406e9e77dea15fa6f94478c6d98b2b8bf

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 18:23

Target

2024-02-12_110f33d281b8438d973e88f692112a0a_cryptolocker.exe
Size

385KB
MD5

110f33d281b8438d973e88f692112a0a
SHA1

eaa2a984857e3311c7c2a49b34eb77082fa365d0
SHA256

8de82a43b453a7693ce12e2852a9834406e9e77dea15fa6f94478c6d98b2b8bf
SHA512

9d298136e3abb69b0a4be8d254d0ac15a50310169ab2629009c0c26103a56a513e277a49c85b70acc10f965a0eb0200a1e53a18aba1762855cc455899d4f04d2
SSDEEP

6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzXb:nnOflT/ZFIjBz3xjTxynGUOUhXb

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

1312 hasfj.exe
Loads dropped DLL 1 IoCs

Processes:

2024-02-12_110f33d281b8438d973e88f692112a0a_cryptolocker.exe

pid process

1764 2024-02-12_110f33d281b8438d973e88f692112a0a_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1312	hasfj.exe

pid	process
1764	2024-02-12_110f33d281b8438d973e88f692112a0a_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-02-12_110f33d281b8438d973e88f692112a0a_cryptolocker.exe

description	pid	process	target process
PID 1764 wrote to memory of 1312	1764	2024-02-12_110f33d281b8438d973e88f692112a0a_cryptolocker.exe	hasfj.exe
PID 1764 wrote to memory of 1312	1764	2024-02-12_110f33d281b8438d973e88f692112a0a_cryptolocker.exe	hasfj.exe
PID 1764 wrote to memory of 1312	1764	2024-02-12_110f33d281b8438d973e88f692112a0a_cryptolocker.exe	hasfj.exe
PID 1764 wrote to memory of 1312	1764	2024-02-12_110f33d281b8438d973e88f692112a0a_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:1312

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
385KB

MD5
fbbb6ad3e68c6ba8a9fed00912cf110d

SHA1
3204642f17f9181f058cacbbf7fceb354b4f9e71

SHA256
308bf782ff0f15cd672de7a11cb02ea04a151b9dace173ee07064cfc649a9dea

SHA512
7f71ed814ac97964e38289f9f4e3c0c408b15133d12071fb5dad95f8f776b530ab9c548dd8aac700036eb5460b92f9797a1d2c5e4e6cd156f34c67dee6a97efb

Download Submit
memory/1312-15-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/1312-16-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1764-0-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/1764-1-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/1764-2-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download