20929b8fc4cdfc737ce84b44a3c7fe4fff5e9729a14744f2718921c6d00e53dc

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:34

Target

2024-05-23_4970c2a54404934915948bda26c7354f_cryptolocker.exe
Size

44KB
MD5

4970c2a54404934915948bda26c7354f
SHA1

e25e4dfd8fd9941e99bc8205b6103d4363977458
SHA256

20929b8fc4cdfc737ce84b44a3c7fe4fff5e9729a14744f2718921c6d00e53dc
SHA512

479add34f30d29ecbdac84de6688870ce54b5ce7b1c7234d6566372f716a5faac49f737a6d010a019eb888cfc30b5e84e76b8f7a151152fdf3cf3e4a9a3a5431
SSDEEP

384:bm74uGLLQRcsdeQ72ngEr4K7YmE8jo0nrlwfjDUm3yKu:bm74zYcgT/Ekn0ryfjw

Score

9^/10

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2100-0-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/3008-16-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2100-15-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2
behavioral1/memory/3008-26-0x0000000008000000-0x000000000800D000-memory.dmp	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

3008 hasfj.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-23_4970c2a54404934915948bda26c7354f_cryptolocker.exe

pid process

2100 2024-05-23_4970c2a54404934915948bda26c7354f_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3008	hasfj.exe

pid	process
2100	2024-05-23_4970c2a54404934915948bda26c7354f_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-23_4970c2a54404934915948bda26c7354f_cryptolocker.exe

description	pid	process	target process
PID 2100 wrote to memory of 3008	2100	2024-05-23_4970c2a54404934915948bda26c7354f_cryptolocker.exe	hasfj.exe
PID 2100 wrote to memory of 3008	2100	2024-05-23_4970c2a54404934915948bda26c7354f_cryptolocker.exe	hasfj.exe
PID 2100 wrote to memory of 3008	2100	2024-05-23_4970c2a54404934915948bda26c7354f_cryptolocker.exe	hasfj.exe
PID 2100 wrote to memory of 3008	2100	2024-05-23_4970c2a54404934915948bda26c7354f_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:3008

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
Filesize
44KB

MD5
312679ece1cc2988a836f62dd1b5729e

SHA1
ef34792ba01780910e98de985416a48f21eaac65

SHA256
24dbeae1d235c5b9c7d5966a02a582e3f25397843ff02204571b5eb4ba07f100

SHA512
43a3ad54a3764d380e584ad0350d62a25de1851cbfafd5339465cfac8be53b88f244184b5bfd1aa831aa244c84d2eba718cc2b9770e14c00a4b315c5787dfb05

Download Submit
memory/2100-0-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/2100-2-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2100-1-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2100-9-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2100-15-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/3008-16-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/3008-19-0x00000000004C0000-0x00000000004C6000-memory.dmp

Filesize
24KB

Download
memory/3008-18-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/3008-26-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download