db2ada044e5f10903e6e982e4308410932db812b260d75d1bf06f25d89a3aaef

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 19:07

Target

20240521148cc52cdcf7e5ae122db7a03311cdd8cryptolocker.exe
Size

38KB
MD5

148cc52cdcf7e5ae122db7a03311cdd8
SHA1

1d4bb1e50f47e21a1ed3388fec2781070a2993d7
SHA256

db2ada044e5f10903e6e982e4308410932db812b260d75d1bf06f25d89a3aaef
SHA512

365189635156583261d60aa2754996c3afdcf044de7d0423d1971bf24eecae29edc6846ffa862e2a86177f400eb1ab135698ced973bd713408cdb7ad9df0661c
SSDEEP

768:bA74zYcgT/Ekd0ryfjPIunqpeNswmT3He:bA6YcA/X6G0W143+

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

1208 hasfj.exe
Loads dropped DLL 1 IoCs

Processes:

20240521148cc52cdcf7e5ae122db7a03311cdd8cryptolocker.exe

pid process

3028 20240521148cc52cdcf7e5ae122db7a03311cdd8cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1208	hasfj.exe

pid	process
3028	20240521148cc52cdcf7e5ae122db7a03311cdd8cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

20240521148cc52cdcf7e5ae122db7a03311cdd8cryptolocker.exe

description	pid	process	target process
PID 3028 wrote to memory of 1208	3028	20240521148cc52cdcf7e5ae122db7a03311cdd8cryptolocker.exe	hasfj.exe
PID 3028 wrote to memory of 1208	3028	20240521148cc52cdcf7e5ae122db7a03311cdd8cryptolocker.exe	hasfj.exe
PID 3028 wrote to memory of 1208	3028	20240521148cc52cdcf7e5ae122db7a03311cdd8cryptolocker.exe	hasfj.exe
PID 3028 wrote to memory of 1208	3028	20240521148cc52cdcf7e5ae122db7a03311cdd8cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\20240521148cc52cdcf7e5ae122db7a03311cdd8cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\20240521148cc52cdcf7e5ae122db7a03311cdd8cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1208

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
38KB

MD5
d70675a963e8b97afb8c289b9889aea8

SHA1
1e86d5045a159c2742293f2f8a9fb673c9f7417e

SHA256
4f776a8f54b04d066d1572e68b918816aeac09bf975de04cd98baf79c4ba3228

SHA512
4041f22cfb34d4cec708a66e5a1eb8170217d65a5208d5f49b1eb0922a735263a26a00840140cc156e77a5913433b83ab24b41dbd405abf0eea2a5ab9609b7ff

Download Submit
memory/1208-22-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/1208-15-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/3028-8-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/3028-1-0x00000000003A0000-0x00000000003A6000-memory.dmp

Filesize
24KB

Download
memory/3028-0-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download