17c7c9f68ffa309f4cef85738f9ee8d54e417e8fcd59b94555ac938ee80b1082

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:27

Target

2024-05-21_5e8da3cf68558e2cc1c70d4133b25bea_cryptolocker.exe
Size

41KB
MD5

5e8da3cf68558e2cc1c70d4133b25bea
SHA1

613917fd16dc73a9bec8c3a3a8132cb49bfdc350
SHA256

17c7c9f68ffa309f4cef85738f9ee8d54e417e8fcd59b94555ac938ee80b1082
SHA512

ba3dc30a9cb3a903870f1705a1269896f8c5746af06ce9bb75de6121628157486dfadbe0436f20027c7466b29ce3abfc13fe61c28c28967198984bfbdf4f5b71
SSDEEP

768:bA74zYcgT/Ekd0ryfjPIunqpeNswmT3Hwp:bA6YcA/X6G0W143Qp

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

2476 hasfj.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-21_5e8da3cf68558e2cc1c70d4133b25bea_cryptolocker.exe

pid process

1728 2024-05-21_5e8da3cf68558e2cc1c70d4133b25bea_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2476	hasfj.exe

pid	process
1728	2024-05-21_5e8da3cf68558e2cc1c70d4133b25bea_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-21_5e8da3cf68558e2cc1c70d4133b25bea_cryptolocker.exe

description	pid	process	target process
PID 1728 wrote to memory of 2476	1728	2024-05-21_5e8da3cf68558e2cc1c70d4133b25bea_cryptolocker.exe	hasfj.exe
PID 1728 wrote to memory of 2476	1728	2024-05-21_5e8da3cf68558e2cc1c70d4133b25bea_cryptolocker.exe	hasfj.exe
PID 1728 wrote to memory of 2476	1728	2024-05-21_5e8da3cf68558e2cc1c70d4133b25bea_cryptolocker.exe	hasfj.exe
PID 1728 wrote to memory of 2476	1728	2024-05-21_5e8da3cf68558e2cc1c70d4133b25bea_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_5e8da3cf68558e2cc1c70d4133b25bea_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_5e8da3cf68558e2cc1c70d4133b25bea_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2476

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
41KB

MD5
1ae49af9dd77ce73acb05bfff638ec8c

SHA1
8773dc99f6450820fd46f44862d483685403af07

SHA256
9483a0a24ffcc11b8f94f628492f3e9f7d35e4c76e69ddd158a4cb3e94337971

SHA512
4ff81f871d4a058ad576e6c72640dd745f03ce33a6b0faa8ddc370d03b2725f9ac4d18d4ef82452bd9fa9cceb395af927bd060c9f8cfadee1e1f325b9c3d3ec7

Download Submit
memory/1728-0-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1728-8-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1728-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2476-15-0x0000000002920000-0x0000000002926000-memory.dmp

Filesize
24KB

Download
memory/2476-16-0x0000000002D00000-0x0000000002D06000-memory.dmp

Filesize
24KB

Download