4ee383a1a7269175b9c469362cd7a1152c0d7603a5b387b285e5065ea8e43ae2

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 20:01

Target

2024-02-12_efcc0940fad0ac891b059925fff37baf_cryptolocker.exe
Size

35KB
MD5

efcc0940fad0ac891b059925fff37baf
SHA1

bbfe8720e5b7c69e6af302068a8e8440e70990a8
SHA256

4ee383a1a7269175b9c469362cd7a1152c0d7603a5b387b285e5065ea8e43ae2
SHA512

e48a6a68ecccebe1b9dfeac861becf354f1135619989715702b963002ff13b59112e46fe941fdc9f689f6c7f7fa889642eea27834411db0c7f11d48a5f2326ca
SSDEEP

768:bA74zYcgT/Ekd0ryfjPIunqpeNswmT3H4:bA6YcA/X6G0W143Y

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

2984 hasfj.exe
Loads dropped DLL 1 IoCs

Processes:

2024-02-12_efcc0940fad0ac891b059925fff37baf_cryptolocker.exe

pid process

2212 2024-02-12_efcc0940fad0ac891b059925fff37baf_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2984	hasfj.exe

pid	process
2212	2024-02-12_efcc0940fad0ac891b059925fff37baf_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-02-12_efcc0940fad0ac891b059925fff37baf_cryptolocker.exe

description	pid	process	target process
PID 2212 wrote to memory of 2984	2212	2024-02-12_efcc0940fad0ac891b059925fff37baf_cryptolocker.exe	hasfj.exe
PID 2212 wrote to memory of 2984	2212	2024-02-12_efcc0940fad0ac891b059925fff37baf_cryptolocker.exe	hasfj.exe
PID 2212 wrote to memory of 2984	2212	2024-02-12_efcc0940fad0ac891b059925fff37baf_cryptolocker.exe	hasfj.exe
PID 2212 wrote to memory of 2984	2212	2024-02-12_efcc0940fad0ac891b059925fff37baf_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:2984

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
36KB

MD5
c57fb2af34ef9ced3982910df39edd78

SHA1
d8439d74fb08b1a638435a80fa1856519646e4ef

SHA256
9d5ac26eadebfbe922e995ccdc10c3e3a90f91c1b3e7142e1be5cce2bd771f4e

SHA512
e548cde0d3dd767a41dbed208abe19e0587ae34a0ae6861717678aef399e5d2cb109ba8fb4e2c23bd7ed0f2212b2eea4f078d343b55b92b51dde73253ccf93c3

Download Submit
memory/2212-0-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2212-2-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2212-1-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/2984-17-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/2984-15-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download