bf703cca141eca33bb727f7550bf64df3c8546861f8145a8bcdc84eaecf680fc

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 19:17

Target

20240521c24f2116d42a9e3300512dcf163fb0c5cryptolocker.exe
Size

44KB
MD5

c24f2116d42a9e3300512dcf163fb0c5
SHA1

c0d5bcad9a7c1a620860841aeb567f61f39cc884
SHA256

bf703cca141eca33bb727f7550bf64df3c8546861f8145a8bcdc84eaecf680fc
SHA512

262e3676b4ec9e6301d8537f23c480df9dd5d246b8595d67c7d821abf1c47f2d5d3129eb670b3ff2aef2908521e1679293ad4c5579353f8228116efbccd15c78
SSDEEP

384:bm74uGLLQRcsdeQ72ngEr4K7YmE8jo0nrlwfjDUpEui0U3Nf+b:bm74zYcgT/Ekn0ryfjLur

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

2612 hasfj.exe
Loads dropped DLL 1 IoCs

Processes:

20240521c24f2116d42a9e3300512dcf163fb0c5cryptolocker.exe

pid process

2164 20240521c24f2116d42a9e3300512dcf163fb0c5cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2612	hasfj.exe

pid	process
2164	20240521c24f2116d42a9e3300512dcf163fb0c5cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

20240521c24f2116d42a9e3300512dcf163fb0c5cryptolocker.exe

description	pid	process	target process
PID 2164 wrote to memory of 2612	2164	20240521c24f2116d42a9e3300512dcf163fb0c5cryptolocker.exe	hasfj.exe
PID 2164 wrote to memory of 2612	2164	20240521c24f2116d42a9e3300512dcf163fb0c5cryptolocker.exe	hasfj.exe
PID 2164 wrote to memory of 2612	2164	20240521c24f2116d42a9e3300512dcf163fb0c5cryptolocker.exe	hasfj.exe
PID 2164 wrote to memory of 2612	2164	20240521c24f2116d42a9e3300512dcf163fb0c5cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\20240521c24f2116d42a9e3300512dcf163fb0c5cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\20240521c24f2116d42a9e3300512dcf163fb0c5cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:2612

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
44KB

MD5
47d5a026c133aa85a95b1d68c84ac2d8

SHA1
14c47b2b5e4362d7d1a3053d3a2b99e83c27a7fd

SHA256
2bcbe2a1daf3800011539428665c0287641820ab16bc6110501c372a6a7daec3

SHA512
936a49f1034bc1d0c453f4a0d8fb76f0c6d0aa5963685ad809fbedb8ebc805cc90e8e0339651d11df18c33568ff6455c87b20a9be3612f349e844f9d6dcf3d0e

Download Submit
memory/2164-0-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/2164-1-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/2164-2-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/2164-9-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/2164-15-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/2612-16-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/2612-18-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2612-25-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/2612-26-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download