0f74f0e7dd2515dbe867411ea457e8419aca05d86543cb88db0ad42b8f1b6040

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:25

Target

2024-05-22_2219e4e87571069a29732df269d7d95a_cryptolocker.exe
Size

41KB
MD5

2219e4e87571069a29732df269d7d95a
SHA1

5bab695426787080020e2602dde8d4d713f998ff
SHA256

0f74f0e7dd2515dbe867411ea457e8419aca05d86543cb88db0ad42b8f1b6040
SHA512

15db488d177c2caca8b756924b8d6bb849b3c74ca1cc9fb92a971f901a5bf3eb709cd4fad5cf21496bcdb1e55730e568689b37fac408f7ef85a28dd8d57e9cb8
SSDEEP

768:bA74zYcgT/Ekd0ryfjPIunqpeNswmT3HwnCi:bA6YcA/X6G0W143QB

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

2304 hasfj.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_2219e4e87571069a29732df269d7d95a_cryptolocker.exe

pid process

2916 2024-05-22_2219e4e87571069a29732df269d7d95a_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2304	hasfj.exe

pid	process
2916	2024-05-22_2219e4e87571069a29732df269d7d95a_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_2219e4e87571069a29732df269d7d95a_cryptolocker.exe

description	pid	process	target process
PID 2916 wrote to memory of 2304	2916	2024-05-22_2219e4e87571069a29732df269d7d95a_cryptolocker.exe	hasfj.exe
PID 2916 wrote to memory of 2304	2916	2024-05-22_2219e4e87571069a29732df269d7d95a_cryptolocker.exe	hasfj.exe
PID 2916 wrote to memory of 2304	2916	2024-05-22_2219e4e87571069a29732df269d7d95a_cryptolocker.exe	hasfj.exe
PID 2916 wrote to memory of 2304	2916	2024-05-22_2219e4e87571069a29732df269d7d95a_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_2219e4e87571069a29732df269d7d95a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_2219e4e87571069a29732df269d7d95a_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2304

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
41KB

MD5
287272a626365ed5a021b2d15789211d

SHA1
149a6fbf1e88ee35221be9fd9b20b7b9438278bf

SHA256
682ad25e4f3b0bd264000eb456201df9150aced61254081bf74d1091a975ce95

SHA512
a825e5c211dc132d812fc88afd21abfc7f35c6ef6beaa295dd5bf52d55d40eef5402046db64f1edbed59633643df7c9beecd5a906716ada45623748bb9946a58

Download Submit
memory/2916-1-0x0000000001CB0000-0x0000000001CB6000-memory.dmp

Filesize
24KB

Download
memory/2916-8-0x0000000001CA0000-0x0000000001CA6000-memory.dmp

Filesize
24KB

Download
memory/2916-0-0x0000000001CA0000-0x0000000001CA6000-memory.dmp

Filesize
24KB

Download