42d1894422e89868bfead8b67fee3f445b424b366029402a4960dcd4310ff333

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 20:00

Target

2024-02-12_5b1d2071ecec8973156b5f67fff633e5_cryptolocker.exe
Size

384KB
MD5

5b1d2071ecec8973156b5f67fff633e5
SHA1

f06fb6677e1bb483c9ca576d47e542027e64189d
SHA256

42d1894422e89868bfead8b67fee3f445b424b366029402a4960dcd4310ff333
SHA512

2993b4f6659c573b6b2dbf1f8ef7bb394b4f4c72050c33c46f2eac1aff23491bf666e67ea3e68313f838feff337665815ea661b7b7f96e04ef72bf82c3d4d729
SSDEEP

6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzXQ:nnOflT/ZFIjBz3xjTxynGUOUhXQ

Score

9^/10

Detection of CryptoLocker Variants 2 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

2864 hasfj.exe
Loads dropped DLL 1 IoCs

Processes:

2024-02-12_5b1d2071ecec8973156b5f67fff633e5_cryptolocker.exe

pid process

2076 2024-02-12_5b1d2071ecec8973156b5f67fff633e5_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2864	hasfj.exe

pid	process
2076	2024-02-12_5b1d2071ecec8973156b5f67fff633e5_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-02-12_5b1d2071ecec8973156b5f67fff633e5_cryptolocker.exe

description	pid	process	target process
PID 2076 wrote to memory of 2864	2076	2024-02-12_5b1d2071ecec8973156b5f67fff633e5_cryptolocker.exe	hasfj.exe
PID 2076 wrote to memory of 2864	2076	2024-02-12_5b1d2071ecec8973156b5f67fff633e5_cryptolocker.exe	hasfj.exe
PID 2076 wrote to memory of 2864	2076	2024-02-12_5b1d2071ecec8973156b5f67fff633e5_cryptolocker.exe	hasfj.exe
PID 2076 wrote to memory of 2864	2076	2024-02-12_5b1d2071ecec8973156b5f67fff633e5_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:2864

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
Filesize
192KB

MD5
2fd1286850e6616eb12abdfd28d51202

SHA1
c7c12af68ffae39f89f3ed7a4df1e981781c98ac

SHA256
729bb955f942ea7cfd99369b4738991fbc8c82fe493de2c7ed66a7ee023b5dbe

SHA512
d13f7a9b93154b2e57db1aa86a9fa8343a05b0a658c1b129db1abdde8cf5856fa20440d488fb517c62ad3a8d63853678f01249dc7fac76621321dae1b0f237a9

Download Submit
\Users\Admin\AppData\Local\Temp\hasfj.exe
Filesize
385KB

MD5
9dd0cda8ef64ce3efc2019fbb29e3bd3

SHA1
49d688140bef44be69578b97dc35b57d56dc7027

SHA256
dbc7e9ad31e352bb11ca7fcf1e023725322770ae4fd38ddab7f0b8bc520e9697

SHA512
5781e2d3d18e63c850b9e7cb8d4cbc22338e27fe7aeac15d5cc58a7afc64230ff1c424be7ae0ff6bd074b959f4fbf942ab33e460747fd84e7ef48447c6c14fd4

Download Submit
memory/2076-0-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2076-1-0x00000000002E0000-0x00000000002E6000-memory.dmp

Filesize
24KB

Download
memory/2076-7-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2864-15-0x0000000000630000-0x0000000000636000-memory.dmp

Filesize
24KB

Download
memory/2864-22-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download