335d6f9e6c6996d18b11510807c965803f1486a93920532c147068cdb026c005

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 20:05

Target

2024-02-12_867acf385aeb34aba0d670e67a65f381_cryptolocker.exe
Size

46KB
MD5

867acf385aeb34aba0d670e67a65f381
SHA1

a910f804a164a685c1e8392abc6f26d431fb9241
SHA256

335d6f9e6c6996d18b11510807c965803f1486a93920532c147068cdb026c005
SHA512

22d185a3024ba90a4225101143597e7ff6e9d44ef3eac5f18d3ceac8fc5c08b1610d784e93c68067cf009f1488ab552e479f2158251fb8d85785917406198189
SSDEEP

768:bgX4zYcgTEu6QOaryfjqDlC6JFbK37Yl6dIDN:bgGYcA/53GAA6y37Q6dIh

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

2848 hasfj.exe
Loads dropped DLL 1 IoCs

Processes:

2024-02-12_867acf385aeb34aba0d670e67a65f381_cryptolocker.exe

pid process

2236 2024-02-12_867acf385aeb34aba0d670e67a65f381_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2848	hasfj.exe

pid	process
2236	2024-02-12_867acf385aeb34aba0d670e67a65f381_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-02-12_867acf385aeb34aba0d670e67a65f381_cryptolocker.exe

description	pid	process	target process
PID 2236 wrote to memory of 2848	2236	2024-02-12_867acf385aeb34aba0d670e67a65f381_cryptolocker.exe	hasfj.exe
PID 2236 wrote to memory of 2848	2236	2024-02-12_867acf385aeb34aba0d670e67a65f381_cryptolocker.exe	hasfj.exe
PID 2236 wrote to memory of 2848	2236	2024-02-12_867acf385aeb34aba0d670e67a65f381_cryptolocker.exe	hasfj.exe
PID 2236 wrote to memory of 2848	2236	2024-02-12_867acf385aeb34aba0d670e67a65f381_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:2848

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

\Users\Admin\AppData\Local\Temp\hasfj.exe
Filesize
46KB

MD5
999ae7a80ba3f28bc86dc606f5145bc7

SHA1
7fca21d6231fa34bdde0761da90ffa18b2fdf0f0

SHA256
9b2eb7d1b7e54ac628c00a4ce715b6b78fb30112d66ba05b41650c90b1da4b5c

SHA512
2a8c4752193414d3549566484c2f0d96d72f3603706c7d89b009eb43ba2aed7dd511675dec66b21717271d438c393c5fb940bd301a0c91b504f16f0f4f4d76af

Download Submit
memory/2236-0-0x0000000001B20000-0x0000000001B26000-memory.dmp

Filesize
24KB

Download
memory/2236-1-0x0000000001B20000-0x0000000001B26000-memory.dmp

Filesize
24KB

Download
memory/2236-2-0x0000000001B40000-0x0000000001B46000-memory.dmp

Filesize
24KB

Download
memory/2848-15-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2848-18-0x0000000000260000-0x0000000000266000-memory.dmp

Filesize
24KB

Download