7c7e7bc03f44339f281b7ec9729f621c59bfb61bd4681167267590a657364e77

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 05:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-18_b1110084afc694f9d9e47fac559951d3_cryptolocker.exe
Size

29KB
MD5

b1110084afc694f9d9e47fac559951d3
SHA1

e00dd305e3616445e9900a45dcd9f15c0776bcff
SHA256

7c7e7bc03f44339f281b7ec9729f621c59bfb61bd4681167267590a657364e77
SHA512

f3360638e451ebfc2b5af832e91b48b84b9828fb1c5800710ab995cfd8727577dcb1315d0fd74d371b0c4840f6c8a96519d6679e19f81f2c32158bd95bd939cc
SSDEEP

384:bA74uGLLQRcsdeQ72ngEr4K7YmE8j60nrlwfjDUr766SJ1C:bA74zYcgT/Ekd0ryfjQRS+

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2060	hasfj.exe

Loads dropped DLL 1 IoCs

pid	Process
1964	2024-10-18_b1110084afc694f9d9e47fac559951d3_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-18_b1110084afc694f9d9e47fac559951d3_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hasfj.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2060	1964	2024-10-18_b1110084afc694f9d9e47fac559951d3_cryptolocker.exe	30
PID 1964 wrote to memory of 2060	1964	2024-10-18_b1110084afc694f9d9e47fac559951d3_cryptolocker.exe	30
PID 1964 wrote to memory of 2060	1964	2024-10-18_b1110084afc694f9d9e47fac559951d3_cryptolocker.exe	30
PID 1964 wrote to memory of 2060	1964	2024-10-18_b1110084afc694f9d9e47fac559951d3_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-10-18_b1110084afc694f9d9e47fac559951d3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-18_b1110084afc694f9d9e47fac559951d3_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\hasfj.exe
  "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hasfj.exe

Filesize
29KB

MD5
ae49d3040aaf92656bbb1ce0b979a02d

SHA1
4eeb10aec7cf28f54a3ad3c93c5a98c1a64a05cf

SHA256
806229245aefa02536f1a604349df0a0e3d50bc2520052bb1d2552aa88fb4e1b

SHA512
cb06931bad1a66e9aedee83e311d8ba6e69ff3d60667de3d7272ecde921bb0d4629bf7143384707ed37e5de6b42135b1932bffbe6bc6689d2f0d85191b1ba195

Download Submit
memory/1964-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1964-8-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1964-0-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2060-15-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2060-16-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download