5b999837dc80e58d91df271bfce0dead0f92af299dcf062c29399e238eb717b4

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-25_7cdda9ba3ae4c39b39083d354214b5d1_cryptolocker.exe
Size

392KB
MD5

7cdda9ba3ae4c39b39083d354214b5d1
SHA1

57d3123644c438e7743b01cbccf8072f25ac0988
SHA256

5b999837dc80e58d91df271bfce0dead0f92af299dcf062c29399e238eb717b4
SHA512

cfba224f3a5d48eddf1ee9a3dbd655e39fd0929afac029ae3a7164388c2002b7c92d0bbc87321998e42572d25843f64331d70ac0e41e863411bea36d79a9c8c7
SSDEEP

6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzXS:nnOflT/ZFIjBz3xjTxynGUOUhXS

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1764	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2416	2024-07-25_7cdda9ba3ae4c39b39083d354214b5d1_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-07-25_7cdda9ba3ae4c39b39083d354214b5d1_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hasfj.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 1764	2416	2024-07-25_7cdda9ba3ae4c39b39083d354214b5d1_cryptolocker.exe	30
PID 2416 wrote to memory of 1764	2416	2024-07-25_7cdda9ba3ae4c39b39083d354214b5d1_cryptolocker.exe	30
PID 2416 wrote to memory of 1764	2416	2024-07-25_7cdda9ba3ae4c39b39083d354214b5d1_cryptolocker.exe	30
PID 2416 wrote to memory of 1764	2416	2024-07-25_7cdda9ba3ae4c39b39083d354214b5d1_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-07-25_7cdda9ba3ae4c39b39083d354214b5d1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-25_7cdda9ba3ae4c39b39083d354214b5d1_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
392KB

MD5
b253481125f3434a8cf034da2851090a

SHA1
b76e4c43f12382c223a444abad39d48907f8748d

SHA256
97970780ffcb265e67eb2b52f44dcd033f388aed58c6f650ed2c17b457f8b05f

SHA512
49c17e0eec73c52817a80d2893db0ec547434657331f414b9966b3ddcc42c429fa6ffed4780db97beb14c0a7a1f79ac12b7cb06fb8a643aeee2ee7fae73a12dd

Download Submit
memory/1764-15-0x0000000000580000-0x0000000000586000-memory.dmp

Filesize
24KB

Download
memory/1764-22-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2416-0-0x00000000003D0000-0x00000000003D6000-memory.dmp

Filesize
24KB

Download
memory/2416-1-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/2416-8-0x00000000003D0000-0x00000000003D6000-memory.dmp

Filesize
24KB

Download