69760d0761dd05987d56f54740e1d3748c3f4865b0668e665096b178f42c6b4b

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 20:15

Target

2024-02-12_b3e06f54bdf622de6999cf91c6bd6e11_cryptolocker.exe
Size

385KB
MD5

b3e06f54bdf622de6999cf91c6bd6e11
SHA1

727c877de245988c78a3226e262b8fb165475d06
SHA256

69760d0761dd05987d56f54740e1d3748c3f4865b0668e665096b178f42c6b4b
SHA512

d5981c50f155ade97d7f92a99af8f010c755eaad03f253801e519a5e62ceb0ac99c48281731c1247a5839edc342eb6eaeb77bf7505dfd7a15c10570f0cea4e01
SSDEEP

6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzXs:nnOflT/ZFIjBz3xjTxynGUOUhXs

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

2644 hasfj.exe
Loads dropped DLL 1 IoCs

Processes:

2024-02-12_b3e06f54bdf622de6999cf91c6bd6e11_cryptolocker.exe

pid process

2084 2024-02-12_b3e06f54bdf622de6999cf91c6bd6e11_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2644	hasfj.exe

pid	process
2084	2024-02-12_b3e06f54bdf622de6999cf91c6bd6e11_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-02-12_b3e06f54bdf622de6999cf91c6bd6e11_cryptolocker.exe

description	pid	process	target process
PID 2084 wrote to memory of 2644	2084	2024-02-12_b3e06f54bdf622de6999cf91c6bd6e11_cryptolocker.exe	hasfj.exe
PID 2084 wrote to memory of 2644	2084	2024-02-12_b3e06f54bdf622de6999cf91c6bd6e11_cryptolocker.exe	hasfj.exe
PID 2084 wrote to memory of 2644	2084	2024-02-12_b3e06f54bdf622de6999cf91c6bd6e11_cryptolocker.exe	hasfj.exe
PID 2084 wrote to memory of 2644	2084	2024-02-12_b3e06f54bdf622de6999cf91c6bd6e11_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:2644

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
385KB

MD5
f5f81cf4fb4e5a3910ffbf5da48ef2b4

SHA1
2c9581e5f591b6f288c23f916910a8e21cd4b0ad

SHA256
b6842b375ce9f22e0d37e99ddd31ee8786c4337add2c1ac417e2c74e9b2c9b86

SHA512
29f47c62f560dfcea895f5e8f8f9a963d62460573a90d6d0231d19291f2cdfe4df5119fa16d95314e0bd209823e11419d6107733d8c54ce44ca5e5f014f35738

Download Submit
memory/2084-0-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2084-1-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2084-8-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2644-15-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/2644-16-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download