ed4ce3dbce4621e0eba61d287cc88092ba58d48101efc266822a4b59b22c01ce

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:32

Target

2024-05-22_4dc6616740c7c7ec8c2bad18306a376b_cryptolocker.exe
Size

40KB
MD5

4dc6616740c7c7ec8c2bad18306a376b
SHA1

fed3e7005ad70da83339f54cca32d76abfbe1f5d
SHA256

ed4ce3dbce4621e0eba61d287cc88092ba58d48101efc266822a4b59b22c01ce
SHA512

e21c9fe021b0c10401ad47d1eccb9e2a9de432aadf591ad7606f94cea64acd9c2f07820b5c0f9c32d706f729ab89861942bd60190bb4ea0bd456dce7bc606875
SSDEEP

768:bA74zYcgT/Ekd0ryfjPIunqpeNswmxT4HmM:bA6YcA/X6G0W1BGM

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

2016 hasfj.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_4dc6616740c7c7ec8c2bad18306a376b_cryptolocker.exe

pid process

1700 2024-05-22_4dc6616740c7c7ec8c2bad18306a376b_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2016	hasfj.exe

pid	process
1700	2024-05-22_4dc6616740c7c7ec8c2bad18306a376b_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_4dc6616740c7c7ec8c2bad18306a376b_cryptolocker.exe

description	pid	process	target process
PID 1700 wrote to memory of 2016	1700	2024-05-22_4dc6616740c7c7ec8c2bad18306a376b_cryptolocker.exe	hasfj.exe
PID 1700 wrote to memory of 2016	1700	2024-05-22_4dc6616740c7c7ec8c2bad18306a376b_cryptolocker.exe	hasfj.exe
PID 1700 wrote to memory of 2016	1700	2024-05-22_4dc6616740c7c7ec8c2bad18306a376b_cryptolocker.exe	hasfj.exe
PID 1700 wrote to memory of 2016	1700	2024-05-22_4dc6616740c7c7ec8c2bad18306a376b_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:2016

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

\Users\Admin\AppData\Local\Temp\hasfj.exe
Filesize
40KB

MD5
7b7eb1fa9e20aae14c459aecb9259c43

SHA1
398ba48d025e424e3dd05eb211dae40382e8b5ce

SHA256
11f677ba901e0c202f260cbf0dd524ab8b5c24eef947a1e56e6cd3db4c04cae2

SHA512
65f786d7fade1aa1224328692146922d58c51f2ca13df917a12585b397dc3e517934fdbf7c59a6c61625ab43c3f6b9c90a912bf19e3563b64aa3a0be34aae318

Download Submit
memory/1700-0-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/1700-8-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/1700-1-0x0000000000580000-0x0000000000586000-memory.dmp

Filesize
24KB

Download
memory/2016-15-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2016-22-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download