5cc492994da044a5b9f2de9c7fe0941528613920ac9722ec555f3e74f83395a3

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 20:23

Target

2024-02-12_d7caa038ed6c306d814bb1b50e401dc8_cryptolocker.exe
Size

36KB
MD5

d7caa038ed6c306d814bb1b50e401dc8
SHA1

858c1b1aa3206b40026dcd5af7212c724c0cb91f
SHA256

5cc492994da044a5b9f2de9c7fe0941528613920ac9722ec555f3e74f83395a3
SHA512

528d6b041836a4012eda390fa2724984e72983f7912cc54a41a491da5783050d8b5edca19b36b6d3b10a6aed5b21f52b4ba6c0a080947683f411dd632b49e364
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUgIunIVpeNs23mAA6lukoi:bA74zYcgT/Ekd0ryfjPIunqpeNswmNkb

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

2384 hasfj.exe
Loads dropped DLL 1 IoCs

Processes:

2024-02-12_d7caa038ed6c306d814bb1b50e401dc8_cryptolocker.exe

pid process

1992 2024-02-12_d7caa038ed6c306d814bb1b50e401dc8_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2384	hasfj.exe

pid	process
1992	2024-02-12_d7caa038ed6c306d814bb1b50e401dc8_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-02-12_d7caa038ed6c306d814bb1b50e401dc8_cryptolocker.exe

description	pid	process	target process
PID 1992 wrote to memory of 2384	1992	2024-02-12_d7caa038ed6c306d814bb1b50e401dc8_cryptolocker.exe	hasfj.exe
PID 1992 wrote to memory of 2384	1992	2024-02-12_d7caa038ed6c306d814bb1b50e401dc8_cryptolocker.exe	hasfj.exe
PID 1992 wrote to memory of 2384	1992	2024-02-12_d7caa038ed6c306d814bb1b50e401dc8_cryptolocker.exe	hasfj.exe
PID 1992 wrote to memory of 2384	1992	2024-02-12_d7caa038ed6c306d814bb1b50e401dc8_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:2384

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
36KB

MD5
cc2209e9b763aae208b99026785ca516

SHA1
ddf57c9385674c618692872e123816f58a38e47f

SHA256
03e7245a4f31b8c2ebbb40e156e9fbd4e77e2d24ebdf8e166cbd06958a813ba1

SHA512
63cc1b0e8266d5f0e6b7b2bc3ff8be699126cfad4eed92bf1eecacd265284426fc6d63e06f578fbc21b3f7ffcfe93bd413375b33072922cdf19ba33f477ffc77

Download Submit
memory/1992-0-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/1992-2-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/1992-1-0x0000000001CB0000-0x0000000001CB6000-memory.dmp

Filesize
24KB

Download
memory/2384-15-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2384-22-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download