aae2a2618318c9a84312833ba0deb1108a5b13ec0b3c1dc95c8e42d7b32e881f

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:37

Target

2024-05-21_4700e2ab30986b42170c21e6324783cc_cryptolocker.exe
Size

40KB
MD5

4700e2ab30986b42170c21e6324783cc
SHA1

d06d8e17625d0885ac86a5c6a6ae6f55406bbc1b
SHA256

aae2a2618318c9a84312833ba0deb1108a5b13ec0b3c1dc95c8e42d7b32e881f
SHA512

a99daf463a53dd25c506c49a613e6ece7c224f4f7ef835b0e473dddda96d8993cec9975a23b7f4f092926098ebb107522a95471ce906688ce082f8b77ac780b5
SSDEEP

768:bA74zYcgT/Ekd0ryfjPIunqpeNswmT3HwT9W:bA6YcA/X6G0W143QTY

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

2096 hasfj.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-21_4700e2ab30986b42170c21e6324783cc_cryptolocker.exe

pid process

2288 2024-05-21_4700e2ab30986b42170c21e6324783cc_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2096	hasfj.exe

pid	process
2288	2024-05-21_4700e2ab30986b42170c21e6324783cc_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-21_4700e2ab30986b42170c21e6324783cc_cryptolocker.exe

description	pid	process	target process
PID 2288 wrote to memory of 2096	2288	2024-05-21_4700e2ab30986b42170c21e6324783cc_cryptolocker.exe	hasfj.exe
PID 2288 wrote to memory of 2096	2288	2024-05-21_4700e2ab30986b42170c21e6324783cc_cryptolocker.exe	hasfj.exe
PID 2288 wrote to memory of 2096	2288	2024-05-21_4700e2ab30986b42170c21e6324783cc_cryptolocker.exe	hasfj.exe
PID 2288 wrote to memory of 2096	2288	2024-05-21_4700e2ab30986b42170c21e6324783cc_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:2096

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
40KB

MD5
a74708971cefcedc69c94f49db497a08

SHA1
8712fa1835681b97b8f4da2d0e620075e40fe307

SHA256
ed1697a909940966d5c3c663764b7d0f2b3c9d26a814c5852544a9f72725db75

SHA512
4f431b17099b4d55ab58d6849f47ae0d721cf70d79d9886c5e4cec88e5ab35223e2a8fc39cfb95097420cfb0703c4f0bab09b3b300f818ac625ffbf0d4583541

Download Submit
memory/2096-22-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/2096-15-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/2288-0-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/2288-1-0x00000000004C0000-0x00000000004C6000-memory.dmp

Filesize
24KB

Download
memory/2288-8-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download