33cd48b797a51192ac5578b67e534e6ca5effac76c685bc8d50082007eb2c920

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:32

Target

2024-05-22_5201163219dbaf4cafe1af292a4baffb_cryptolocker.exe
Size

33KB
MD5

5201163219dbaf4cafe1af292a4baffb
SHA1

4d94ef674860062731a01f042cd1b61df61af2b1
SHA256

33cd48b797a51192ac5578b67e534e6ca5effac76c685bc8d50082007eb2c920
SHA512

7bf5bb6f53db10bc2696551eea9490c3070d603af86c6c858936d6d7a5c3417e4b2924dbad373f3c0e32e607d56e0995ca7e9ca269fc149b1b3a21f4b181d377
SSDEEP

384:bG74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUGTGLZ92:bG74zYcgT/Ekd0ryfjgj2

Score

9^/10

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1936-0-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2
behavioral1/memory/1936-15-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2080-16-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2080-26-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

2080 hasfj.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_5201163219dbaf4cafe1af292a4baffb_cryptolocker.exe

pid process

1936 2024-05-22_5201163219dbaf4cafe1af292a4baffb_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2080	hasfj.exe

pid	process
1936	2024-05-22_5201163219dbaf4cafe1af292a4baffb_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_5201163219dbaf4cafe1af292a4baffb_cryptolocker.exe

description	pid	process	target process
PID 1936 wrote to memory of 2080	1936	2024-05-22_5201163219dbaf4cafe1af292a4baffb_cryptolocker.exe	hasfj.exe
PID 1936 wrote to memory of 2080	1936	2024-05-22_5201163219dbaf4cafe1af292a4baffb_cryptolocker.exe	hasfj.exe
PID 1936 wrote to memory of 2080	1936	2024-05-22_5201163219dbaf4cafe1af292a4baffb_cryptolocker.exe	hasfj.exe
PID 1936 wrote to memory of 2080	1936	2024-05-22_5201163219dbaf4cafe1af292a4baffb_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:2080

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
Filesize
33KB

MD5
377b288ac2c2f552d995ffff742ae28a

SHA1
194a82d78d8f47c2e49279b9ccee230de9e464eb

SHA256
16e0bf2af95105c2a2cbc39a43960b66307116b6ae61a03e809ac0ae19d3aee0

SHA512
f74d7b173c91e48d9fb4e37b19f0e9da417f2145239834e646476ee2b30bca7e17f337d7ae9c4be331aafa28586963587a87f8493b149b60134c54dcfb3d448b

Download Submit
memory/1936-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/1936-1-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/1936-2-0x00000000003A0000-0x00000000003A6000-memory.dmp

Filesize
24KB

Download
memory/1936-9-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/1936-15-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2080-16-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2080-18-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/2080-25-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/2080-26-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download