73dddf15d94254daa2a16d04424a537dde3b1107b5c1d906aa9573b0eb46c3da

Analysis

max time kernel
148s
max time network
154s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/08/2024, 08:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-07_1af96f3df896e372d866bc3f870d4b5f_cryptolocker.exe
Size

393KB
MD5

1af96f3df896e372d866bc3f870d4b5f
SHA1

0dd00f9f6624f37189aa023a8af36bc04c9add29
SHA256

73dddf15d94254daa2a16d04424a537dde3b1107b5c1d906aa9573b0eb46c3da
SHA512

2991105d6155f04775992995765ab89e79a0bf72b12449474fcc586f87fe4da952404ec4c92ed9dd55db3ae68d7e326fef8a6875f1caf052b9daa54674e5deb7
SSDEEP

6144:nnOsaQgAOjvrZFODJjBz3j1jTqQy6v2GGnugOtihzXRr:nnOflT/ZFIjBz3xjTxynGUOUhXRr

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2800	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2732	2024-08-07_1af96f3df896e372d866bc3f870d4b5f_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-07_1af96f3df896e372d866bc3f870d4b5f_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hasfj.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2800	2732	2024-08-07_1af96f3df896e372d866bc3f870d4b5f_cryptolocker.exe	30
PID 2732 wrote to memory of 2800	2732	2024-08-07_1af96f3df896e372d866bc3f870d4b5f_cryptolocker.exe	30
PID 2732 wrote to memory of 2800	2732	2024-08-07_1af96f3df896e372d866bc3f870d4b5f_cryptolocker.exe	30
PID 2732 wrote to memory of 2800	2732	2024-08-07_1af96f3df896e372d866bc3f870d4b5f_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-08-07_1af96f3df896e372d866bc3f870d4b5f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-07_1af96f3df896e372d866bc3f870d4b5f_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
394KB

MD5
22dbc83b481d8be6cd3385199475c894

SHA1
7ab9cfda9e3b021d485a1656a4b25f884054bda2

SHA256
d6042d761b3938e9d7882180aa6c4093d075f8438ea7c4b13b92480d12a8ebd6

SHA512
e2b9fbdffdf59ea080ab49b1603b07e0c0d6be8162379223528d091ab8a4ac8eab253b782fff5536e671e3fae2e54c2b6f6e72764bad209251650c814c14dd2d

Download Submit
memory/2732-8-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/2732-1-0x0000000001CE0000-0x0000000001CE6000-memory.dmp

Filesize
24KB

Download
memory/2732-0-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/2800-15-0x0000000001BC0000-0x0000000001BC6000-memory.dmp

Filesize
24KB

Download
memory/2800-22-0x0000000001BA0000-0x0000000001BA6000-memory.dmp

Filesize
24KB

Download