1a66f4c7d00839197c6e110bf8ec7caf2423d69643558436c901a226b8d9d0e8

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 20:02

Target

2024-02-12_71b6f33283aab01e2b6b2034e7fab4a6_cryptolocker.exe
Size

47KB
MD5

71b6f33283aab01e2b6b2034e7fab4a6
SHA1

64b86d90e52dc3637d9934c44848119201321b0a
SHA256

1a66f4c7d00839197c6e110bf8ec7caf2423d69643558436c901a226b8d9d0e8
SHA512

156bfd58597ba226951f11179334dce6b3a939547f4b903908a221641e2154f74d3c661d1c874ead062077602b06b4882b56b32552083d105b23bb5ccfdec949
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37Yl6ddB:bgGYcA/53GAA6y37Q6ddB

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

2336 hasfj.exe
Loads dropped DLL 1 IoCs

Processes:

2024-02-12_71b6f33283aab01e2b6b2034e7fab4a6_cryptolocker.exe

pid process

2868 2024-02-12_71b6f33283aab01e2b6b2034e7fab4a6_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2336	hasfj.exe

pid	process
2868	2024-02-12_71b6f33283aab01e2b6b2034e7fab4a6_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-02-12_71b6f33283aab01e2b6b2034e7fab4a6_cryptolocker.exe

description	pid	process	target process
PID 2868 wrote to memory of 2336	2868	2024-02-12_71b6f33283aab01e2b6b2034e7fab4a6_cryptolocker.exe	hasfj.exe
PID 2868 wrote to memory of 2336	2868	2024-02-12_71b6f33283aab01e2b6b2034e7fab4a6_cryptolocker.exe	hasfj.exe
PID 2868 wrote to memory of 2336	2868	2024-02-12_71b6f33283aab01e2b6b2034e7fab4a6_cryptolocker.exe	hasfj.exe
PID 2868 wrote to memory of 2336	2868	2024-02-12_71b6f33283aab01e2b6b2034e7fab4a6_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:2336

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

\Users\Admin\AppData\Local\Temp\hasfj.exe
Filesize
47KB

MD5
e192d55b8fd2e401dcbbc7db9330feff

SHA1
2736f155a576026f87da6853b87b47476b1c31ac

SHA256
ed0c927d65578dd10b0cb3eef576c9bb48e64e36daf56295b100825075433074

SHA512
9640f54258c42ef99755a2bdfde4665205a3ca3a575bf27635daa2c5b3a4dc7f871f2e8a4724750c6208c5b3578dabb34b1d26faec856ef036d516b92a1fafca

Download Submit
memory/2336-15-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2336-22-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2868-0-0x0000000001CE0000-0x0000000001CE6000-memory.dmp

Filesize
24KB

Download
memory/2868-1-0x0000000001CF0000-0x0000000001CF6000-memory.dmp

Filesize
24KB

Download
memory/2868-7-0x0000000001CE0000-0x0000000001CE6000-memory.dmp

Filesize
24KB

Download