1a48dfbb4c3c998eb928f3c28d64434c35ae140c1e26b7463b23285e3d866dac

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 04:56

Target

2024-05-21_6b83e1e1fc9102152413bb6eec1ff64d_cryptolocker.exe
Size

44KB
MD5

6b83e1e1fc9102152413bb6eec1ff64d
SHA1

75f25eb36dc5bf03dea4bedc20a7bfef31dc4ed4
SHA256

1a48dfbb4c3c998eb928f3c28d64434c35ae140c1e26b7463b23285e3d866dac
SHA512

af77bd1fe87a1a32d6cdf0843f5b70544b72d201b314480226220702fe01a4ca7dc061ec3701e7ebe6ddbe14f4a9523e481f6402d7b3e6bcc4bc5f61e05cf805
SSDEEP

384:bm74uGLLQRcsdeQ72ngEr4K7YmE8jo0nrlwfjDUpEui0U30j:bm74zYcgT/Ekn0ryfjLu5j

Score

9^/10

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2116-0-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000a000000012286-15.dat	CryptoLocker_rule2
behavioral1/memory/2116-14-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2964-16-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2964-26-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2964	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2116	2024-05-21_6b83e1e1fc9102152413bb6eec1ff64d_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2964	2116	2024-05-21_6b83e1e1fc9102152413bb6eec1ff64d_cryptolocker.exe	29
PID 2116 wrote to memory of 2964	2116	2024-05-21_6b83e1e1fc9102152413bb6eec1ff64d_cryptolocker.exe	29
PID 2116 wrote to memory of 2964	2116	2024-05-21_6b83e1e1fc9102152413bb6eec1ff64d_cryptolocker.exe	29
PID 2116 wrote to memory of 2964	2116	2024-05-21_6b83e1e1fc9102152413bb6eec1ff64d_cryptolocker.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-05-21_6b83e1e1fc9102152413bb6eec1ff64d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_6b83e1e1fc9102152413bb6eec1ff64d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2964

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
44KB

MD5
3ec8292ddd493fe72cca4e58c52e9700

SHA1
5450d9d5e97a520059cde3c5af00e4b4845342d9

SHA256
2b87578564d35eadec7f51348a12a826c87485f04019921d1f2232668e0e100c

SHA512
3aa2a5f98e86a9f3962a56e0949ec90110f9fe63f3d34981cf415c7a48c546ac0f607ff3a7a5a8e691ded7636e5fdff2d0e86eff5053524a58601ffdd7fc7338

Download Submit
memory/2116-0-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/2116-1-0x0000000000570000-0x0000000000576000-memory.dmp

Filesize
24KB

Download
memory/2116-2-0x0000000001CB0000-0x0000000001CB6000-memory.dmp

Filesize
24KB

Download
memory/2116-9-0x0000000000570000-0x0000000000576000-memory.dmp

Filesize
24KB

Download
memory/2116-14-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/2964-16-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/2964-18-0x0000000000690000-0x0000000000696000-memory.dmp

Filesize
24KB

Download
memory/2964-25-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2964-26-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download