7a1595818c8f14eb8d75be7d12c53882223c3fbf64c06070d520f60c5aae19f6

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 19:57

Target

2024-02-12_4cc6724f3ac4cc7451d3dce5931b5b6d_cryptolocker.exe
Size

46KB
MD5

4cc6724f3ac4cc7451d3dce5931b5b6d
SHA1

5d6c86a6b37c17762085d4849e1f83bb4962d4fb
SHA256

7a1595818c8f14eb8d75be7d12c53882223c3fbf64c06070d520f60c5aae19f6
SHA512

b73649f3d3a7ee52ff15260cdd7ad87ad5e0d612d150d6a6af86659a8c3a8655438c28264860cb2ee1b220ace3f336e934afec559c1dc8e067ddaa323125bb92
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37Yl6dg4:bgGYcA/53GAA6y37Q6d3

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

2912 hasfj.exe
Loads dropped DLL 1 IoCs

Processes:

2024-02-12_4cc6724f3ac4cc7451d3dce5931b5b6d_cryptolocker.exe

pid process

2140 2024-02-12_4cc6724f3ac4cc7451d3dce5931b5b6d_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2912	hasfj.exe

pid	process
2140	2024-02-12_4cc6724f3ac4cc7451d3dce5931b5b6d_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-02-12_4cc6724f3ac4cc7451d3dce5931b5b6d_cryptolocker.exe

description	pid	process	target process
PID 2140 wrote to memory of 2912	2140	2024-02-12_4cc6724f3ac4cc7451d3dce5931b5b6d_cryptolocker.exe	hasfj.exe
PID 2140 wrote to memory of 2912	2140	2024-02-12_4cc6724f3ac4cc7451d3dce5931b5b6d_cryptolocker.exe	hasfj.exe
PID 2140 wrote to memory of 2912	2140	2024-02-12_4cc6724f3ac4cc7451d3dce5931b5b6d_cryptolocker.exe	hasfj.exe
PID 2140 wrote to memory of 2912	2140	2024-02-12_4cc6724f3ac4cc7451d3dce5931b5b6d_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:2912

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
46KB

MD5
e60b12206bd25b79cc80845ea9a36cf0

SHA1
9cbd07804e44c6c1a1ff7d8a94cb0885b2b4b188

SHA256
e8b9ee0561e7b38a2fb9179777f307d61693c67aad920a94533873cb27f31761

SHA512
c10032fd273b115ce8dab73d1fb92feae8daba92187626a4ec4ab2b0e4d83596c2f36c3acf89a21d2c65c577064ae650f913e6d1d7e791fec290b84843ee1935

Download Submit
memory/2140-0-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2140-1-0x0000000000410000-0x0000000000416000-memory.dmp

Filesize
24KB

Download
memory/2140-2-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2912-15-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2912-22-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download