ea87d5615414728ab91fc62e5d566d0fb52664f2e5c3597ff84d9f1f6b27c6c8

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-10_a247c94dcf86d88f606aff4bea8c15c1_cryptolocker.exe
Size

44KB
MD5

a247c94dcf86d88f606aff4bea8c15c1
SHA1

9b89a7bb7b9e760c96ce3da26829275058ab6223
SHA256

ea87d5615414728ab91fc62e5d566d0fb52664f2e5c3597ff84d9f1f6b27c6c8
SHA512

94877af8b8941844574abd7a8fd42a386260fa134a4d53d6a3ae57fc970897870ae8bb913b262996d1e2605d4aeb0f99c187a7632aabce9287947a97a94c5582
SSDEEP

384:bm74uGLLQRcsdeQ72ngEr4K7YmE8jb0nrlwfjDUadQdrgR:bm74zYcgT/EkM0ryfjPdQeR

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1948	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2276	2024-07-10_a247c94dcf86d88f606aff4bea8c15c1_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 1948	2276	2024-07-10_a247c94dcf86d88f606aff4bea8c15c1_cryptolocker.exe	28
PID 2276 wrote to memory of 1948	2276	2024-07-10_a247c94dcf86d88f606aff4bea8c15c1_cryptolocker.exe	28
PID 2276 wrote to memory of 1948	2276	2024-07-10_a247c94dcf86d88f606aff4bea8c15c1_cryptolocker.exe	28
PID 2276 wrote to memory of 1948	2276	2024-07-10_a247c94dcf86d88f606aff4bea8c15c1_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-07-10_a247c94dcf86d88f606aff4bea8c15c1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-10_a247c94dcf86d88f606aff4bea8c15c1_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
44KB

MD5
305a902b9994fa051abd591a2f69fd17

SHA1
9e2dc3ed5dc30efaa90f11a53f4882c610fda117

SHA256
8265e68a7ffc6cd2eac87706acfb54f7c4d6f770822955ddd0eb0b3e66b3cdbc

SHA512
722471cd8959bea8515fbf5f2368a25da9ae4002cc5861185b685c8be2042690135365de774c1fffd7513df114a908e0a74fd810381c67555dd56660bbce7db7

Download Submit
memory/1948-16-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/1948-18-0x00000000002E0000-0x00000000002E6000-memory.dmp

Filesize
24KB

Download
memory/1948-25-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/1948-26-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/2276-0-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/2276-1-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2276-2-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2276-9-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2276-14-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download