2da0954fa2c90e10f56c0c644815aadc932466334d1523c5c3cd247afd7012f8

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-14_b5c37c2e4b3e7ebe73c29bcd99a7f8d3_cryptolocker.exe
Size

46KB
MD5

b5c37c2e4b3e7ebe73c29bcd99a7f8d3
SHA1

61a9e4e12ca8bded83d3b28ae8f61c815597da67
SHA256

2da0954fa2c90e10f56c0c644815aadc932466334d1523c5c3cd247afd7012f8
SHA512

1b54e0d002a06b3798ceaa7b48d23ec5753c6182f9dd9554b049d151a6c701d216219425a3c5cf939eaf0cb9226c5c660b6666d53f5852f94e7fee5d809170fa
SSDEEP

384:bm74uGLLQRcsdeQ72ngEr4K7YmE8jb0nrlwfjDUadQC8JT:bm74zYcgT/EkM0ryfjPdQZJT

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2084	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
2360	2024-10-14_b5c37c2e4b3e7ebe73c29bcd99a7f8d3_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-14_b5c37c2e4b3e7ebe73c29bcd99a7f8d3_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hasfj.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2084	2360	2024-10-14_b5c37c2e4b3e7ebe73c29bcd99a7f8d3_cryptolocker.exe	31
PID 2360 wrote to memory of 2084	2360	2024-10-14_b5c37c2e4b3e7ebe73c29bcd99a7f8d3_cryptolocker.exe	31
PID 2360 wrote to memory of 2084	2360	2024-10-14_b5c37c2e4b3e7ebe73c29bcd99a7f8d3_cryptolocker.exe	31
PID 2360 wrote to memory of 2084	2360	2024-10-14_b5c37c2e4b3e7ebe73c29bcd99a7f8d3_cryptolocker.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-10-14_b5c37c2e4b3e7ebe73c29bcd99a7f8d3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-14_b5c37c2e4b3e7ebe73c29bcd99a7f8d3_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
46KB

MD5
df0a5edbed41f1e95cc1c7510a6bdbda

SHA1
b357fe4990d381c3fb1d0017906f60be938aafe1

SHA256
c0fd179d16257e1523d5d8d0416844d0911f899dcb260fbbc650ab41ada7d795

SHA512
14560857cc6862aadd02cda1087e7fb6182ecfeca1782bf92a36a3242f1293b3aeac048e64effb8d27883df9d6ab5d5d4aab85a4788dff993c2e7846947cf168

Download Submit
memory/2084-17-0x0000000001CA0000-0x0000000001CA6000-memory.dmp

Filesize
24KB

Download
memory/2084-18-0x0000000001CB0000-0x0000000001CB6000-memory.dmp

Filesize
24KB

Download
memory/2084-25-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/2360-0-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download
memory/2360-1-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2360-9-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2360-2-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2360-15-0x0000000008000000-0x000000000800D000-memory.dmp

Filesize
52KB

Download