9c6624bc16cf70c9d0da1e81bc003d85c61c4bc07f65e280076a40cb83da78b3

Analysis

max time kernel
94s
max time network
149s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:26

Target

2024-05-23_30ee2f276c96c14bd7d8676271fc682d_cryptolocker.exe
Size

36KB
MD5

30ee2f276c96c14bd7d8676271fc682d
SHA1

971de9570847860ae761043e6743bfdb89f7ea63
SHA256

9c6624bc16cf70c9d0da1e81bc003d85c61c4bc07f65e280076a40cb83da78b3
SHA512

c7a96c742806bfadb239943bd023b51ecd7bd2873a654b8f0a229d992348fb0ffd6f8a7ad9f47d61e074fdac4d18c12561314ec8a69860d121e261e35bfeecd7
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUgIunIVpeNs23mAA6lx1hg:bA74zYcgT/Ekd0ryfjPIunqpeNswm60

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\hasfj.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

hasfj.exe

pid process

2764 hasfj.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-23_30ee2f276c96c14bd7d8676271fc682d_cryptolocker.exe

pid process

2944 2024-05-23_30ee2f276c96c14bd7d8676271fc682d_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2764	hasfj.exe

pid	process
2944	2024-05-23_30ee2f276c96c14bd7d8676271fc682d_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-23_30ee2f276c96c14bd7d8676271fc682d_cryptolocker.exe

description	pid	process	target process
PID 2944 wrote to memory of 2764	2944	2024-05-23_30ee2f276c96c14bd7d8676271fc682d_cryptolocker.exe	hasfj.exe
PID 2944 wrote to memory of 2764	2944	2024-05-23_30ee2f276c96c14bd7d8676271fc682d_cryptolocker.exe	hasfj.exe
PID 2944 wrote to memory of 2764	2944	2024-05-23_30ee2f276c96c14bd7d8676271fc682d_cryptolocker.exe	hasfj.exe
PID 2944 wrote to memory of 2764	2944	2024-05-23_30ee2f276c96c14bd7d8676271fc682d_cryptolocker.exe	hasfj.exe

C:\Users\Admin\AppData\Local\Temp\hasfj.exe
"C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
2⤵
- Executes dropped EXE
PID:2764

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

\Users\Admin\AppData\Local\Temp\hasfj.exe
Filesize
36KB

MD5
dca764b3b5e105da37604201b75cc0a1

SHA1
420cd494acb50c55d63a87753796313c4d24e271

SHA256
0c98c6a63d217a6d17374cd05e5394182131a759c5ae7ff12846f406a366c30b

SHA512
dd2d9277cbc6f033014d31da055cc23fccb73dd0046f943560263b792096510740876144d708c3a572395bcf554d231189c46fc036d05ab6d60002a716c4c640

Download Submit
memory/2764-15-0x00000000004C0000-0x00000000004C6000-memory.dmp

Filesize
24KB

Download
memory/2764-22-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2944-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2944-8-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2944-1-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download