a993d8e7734b6a3a3c698dfcf972510113ce50f1f3218b54152a23fed959584b

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 06:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-09-29_c01cd3f7fa9ebf15566b171e429c9863_cryptolocker.exe
Size

33KB
MD5

c01cd3f7fa9ebf15566b171e429c9863
SHA1

21831220ee218be5dc66b9849dbe66991fd70e45
SHA256

a993d8e7734b6a3a3c698dfcf972510113ce50f1f3218b54152a23fed959584b
SHA512

1714d577bfc9aa0ea904095f8661df49cf1bae4779162a4e64f3276403afc49eedd23ec27d2819836c1e4268fbbfe8867bca5ace24e7390268c22c6945b1fe14
SSDEEP

384:bgX4uGLLQRcsdeQ7/nQu63Ag7YmecFanrlwfjDUkKDfWf0w3sp8kpcz:bgX4zYcgTEu6QOaryfjqDDw3sCV

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1624	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
1744	2024-09-29_c01cd3f7fa9ebf15566b171e429c9863_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-29_c01cd3f7fa9ebf15566b171e429c9863_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hasfj.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1624	1744	2024-09-29_c01cd3f7fa9ebf15566b171e429c9863_cryptolocker.exe	30
PID 1744 wrote to memory of 1624	1744	2024-09-29_c01cd3f7fa9ebf15566b171e429c9863_cryptolocker.exe	30
PID 1744 wrote to memory of 1624	1744	2024-09-29_c01cd3f7fa9ebf15566b171e429c9863_cryptolocker.exe	30
PID 1744 wrote to memory of 1624	1744	2024-09-29_c01cd3f7fa9ebf15566b171e429c9863_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-09-29_c01cd3f7fa9ebf15566b171e429c9863_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-29_c01cd3f7fa9ebf15566b171e429c9863_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
33KB

MD5
fb2aae70a97ca5def69f4b6852f1e47a

SHA1
6655dfdca4ded7e491949d0629a8a7996f5e6b6c

SHA256
34521c98eb4f9868f80c3a2906f0c55732456fcf7ad0ccf57de9b301668787b6

SHA512
f6b252acb73e6a1c24e89c5f27d102195092384d2ffb45024fc2b5c3ba8bb5feabe5c7c74c0a31ebb474723c59e8065ba6e5dc8dcda7b6165fe813272bea700f

Download Submit
memory/1624-22-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/1624-15-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/1744-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1744-1-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/1744-8-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download