68306f92dfadd468f708821b057f7c0e047c912b6cfa3b16d5ca4a41dbc3cdad

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 20:04

Target

2024-02-12_7c447cd0a46c75b623f1963731fa209e_cryptolocker.exe
Size

33KB
MD5

7c447cd0a46c75b623f1963731fa209e
SHA1

3b21c8cd424b1aa1d2ff4bb6b572f32c34ed9202
SHA256

68306f92dfadd468f708821b057f7c0e047c912b6cfa3b16d5ca4a41dbc3cdad
SHA512

f0ea830eb3e562df6d23644dafa52b71596d03d582ff66c8a240f32dd3ea933d26eeee9b628ae4dbe240696697a9d7746c6f6e528bfebddf8b73ededa9c22aac
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUgIunexRlSrxVfdsHYUpZ:bA74zYcgT/Ekd0ryfjPIunYw16lZ

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

3064 hasfj.exe
Loads dropped DLL 1 IoCs

Processes:

2024-02-12_7c447cd0a46c75b623f1963731fa209e_cryptolocker.exe

pid process

1652 2024-02-12_7c447cd0a46c75b623f1963731fa209e_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3064	hasfj.exe

pid	process
1652	2024-02-12_7c447cd0a46c75b623f1963731fa209e_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-02-12_7c447cd0a46c75b623f1963731fa209e_cryptolocker.exe

description	pid	process	target process
PID 1652 wrote to memory of 3064	1652	2024-02-12_7c447cd0a46c75b623f1963731fa209e_cryptolocker.exe	hasfj.exe
PID 1652 wrote to memory of 3064	1652	2024-02-12_7c447cd0a46c75b623f1963731fa209e_cryptolocker.exe	hasfj.exe
PID 1652 wrote to memory of 3064	1652	2024-02-12_7c447cd0a46c75b623f1963731fa209e_cryptolocker.exe	hasfj.exe
PID 1652 wrote to memory of 3064	1652	2024-02-12_7c447cd0a46c75b623f1963731fa209e_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:3064

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
34KB

MD5
a80f093650cc894df65f2802ac8ec3e1

SHA1
7956bb9bbaa8dc4945e923d5900c6c7617e7f831

SHA256
0a7da515283fa4915af665ad396f25c4328ac35449347b55daf77663bce0e0c1

SHA512
dcb6971bf48d9327e289e06d7fadbac1ddf8fc928297e99df78709ffcf6b44955e911b1c76e2cff0b37a10cbe5c18b2d376c88b58a2f02befdc665738c0237b7

Download Submit
memory/1652-0-0x00000000003B0000-0x00000000003B6000-memory.dmp

Filesize
24KB

Download
memory/1652-1-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/1652-2-0x00000000003B0000-0x00000000003B6000-memory.dmp

Filesize
24KB

Download
memory/3064-21-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/3064-15-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download