f18ed735e094012b3563947834d89c7d198af9e48452ded31ff1dea1015fea69

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:35

Target

2024-05-22_1e459efa9191ccf70a9d36c52f4f680b_cryptolocker.exe
Size

43KB
MD5

1e459efa9191ccf70a9d36c52f4f680b
SHA1

d8ec9ce9026f5a0f7400b7283d721fea034695b2
SHA256

f18ed735e094012b3563947834d89c7d198af9e48452ded31ff1dea1015fea69
SHA512

ed26307bc14122c906476c2532309eb54c41a8ba938a774e05ad7175ae28cc59dc813b940d77df859aa82c0bd1a2002297b603cb2edf2618c29f2e770186320d
SSDEEP

384:bm74uGLLQRcsdeQ72ngEr4K7YmE8jb0nrlwfjDUkT:bm74zYcgT/EkM0ryfjdT

Score

9^/10

Detection of CryptoLocker Variants 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1612-0-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2
behavioral1/memory/1612-13-0x0000000002B20000-0x0000000002B2D000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1612-16-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2252-17-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2252-27-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

2252 hasfj.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_1e459efa9191ccf70a9d36c52f4f680b_cryptolocker.exe

pid process

1612 2024-05-22_1e459efa9191ccf70a9d36c52f4f680b_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2252	hasfj.exe

pid	process
1612	2024-05-22_1e459efa9191ccf70a9d36c52f4f680b_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_1e459efa9191ccf70a9d36c52f4f680b_cryptolocker.exe

description	pid	process	target process
PID 1612 wrote to memory of 2252	1612	2024-05-22_1e459efa9191ccf70a9d36c52f4f680b_cryptolocker.exe	hasfj.exe
PID 1612 wrote to memory of 2252	1612	2024-05-22_1e459efa9191ccf70a9d36c52f4f680b_cryptolocker.exe	hasfj.exe
PID 1612 wrote to memory of 2252	1612	2024-05-22_1e459efa9191ccf70a9d36c52f4f680b_cryptolocker.exe	hasfj.exe
PID 1612 wrote to memory of 2252	1612	2024-05-22_1e459efa9191ccf70a9d36c52f4f680b_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:2252

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

\Users\Admin\AppData\Local\Temp\hasfj.exe
Filesize
43KB

MD5
38c2179c627b1b04dcf497c8a2fbc8a2

SHA1
482be4603ba42b5ee25ebd7bce42f958cbbdc564

SHA256
e169391004c94bca60c97b8e3df23f3c035378ba0504e12f94498be66f297814

SHA512
b45b6fbe3247e255227e2790b27325dc60913530a2afaaa1fef3b9e302c4e05df182edb8d81b9356688bbd99e8a7b7915c89715269d929192a6066e62f327cfe

Download Submit
memory/1612-0-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/1612-1-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/1612-2-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1612-9-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/1612-13-0x0000000002B20000-0x0000000002B2D000-memory.dmp

Filesize
52KB

Download
memory/1612-16-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/2252-17-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/2252-19-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/2252-26-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2252-27-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download