b11ba87c5f81191a7fcdb5b0a94bbbed1cc2125202fabdcec18090b34e4b5aca

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_e14a275cdb919a4757f3a2974d4053a5_cryptolocker.exe
Size

72KB
MD5

e14a275cdb919a4757f3a2974d4053a5
SHA1

fde3f2cd7e84f937a604ab2e42ab875b2eac6b80
SHA256

b11ba87c5f81191a7fcdb5b0a94bbbed1cc2125202fabdcec18090b34e4b5aca
SHA512

5f7854d07e36f27c2cfa5d0fcff4bed23d196ecb8605e4bf18e158bc2d387a901e68a0f35c33aee405a84bdda5d18104d7d4beeab41548803ffd177ca65dcbd0
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1sdV:X6a+SOtEvwDpjBZYvQd20

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000126af-21.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000126af-21.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
3056	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2928	2024-01-25_e14a275cdb919a4757f3a2974d4053a5_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 3056	2928	2024-01-25_e14a275cdb919a4757f3a2974d4053a5_cryptolocker.exe	16
PID 2928 wrote to memory of 3056	2928	2024-01-25_e14a275cdb919a4757f3a2974d4053a5_cryptolocker.exe	16
PID 2928 wrote to memory of 3056	2928	2024-01-25_e14a275cdb919a4757f3a2974d4053a5_cryptolocker.exe	16
PID 2928 wrote to memory of 3056	2928	2024-01-25_e14a275cdb919a4757f3a2974d4053a5_cryptolocker.exe	16

C:\Users\Admin\AppData\Local\Temp\2024-01-25_e14a275cdb919a4757f3a2974d4053a5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_e14a275cdb919a4757f3a2974d4053a5_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
73KB

MD5
568921875bdc2acc3b6a6d476ae1278a

SHA1
21cea694ca12c88403b1509a89fc60596f6b2763

SHA256
f89fdb92ed1c2802c2feb24a69661a1e22a8e8254024ce435f53921b88325b3c

SHA512
6af0766433a7e8ca2c2f0db254c4a21bdfb4cddda1d4e7d1d19e545f58c34ed6501a2f2c2e621c1db25bfd223eba1a169042980514664ea1b04baaba4fb02004

Download Submit
memory/2928-1-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2928-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2928-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3056-22-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/3056-15-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download