Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 15:38
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-25_7b7f7551062c8ddacd2338b8325d28be_cryptolocker.exe
Resource
win7-20231215-en
General
-
Target
2024-01-25_7b7f7551062c8ddacd2338b8325d28be_cryptolocker.exe
-
Size
50KB
-
MD5
7b7f7551062c8ddacd2338b8325d28be
-
SHA1
b8cc01f46c5eb5fe2baf04f82bd38d180f9e8b37
-
SHA256
711116df3c0bfe2d3095f7fda18d1d8c81d5304e9611feaaecca9951f2ae6c22
-
SHA512
7ce79337344c7f5d5abe6fe07fef6ca2af10a1ac20e3f89dd53f228e4fb337b9606a99e4d418ae3ffcbd9905a4243e9b362e1773642a6704d1490b733e25bc6c
-
SSDEEP
768:79inqyNR/QtOOtEvwDpjBK/rJ+Nw8qn8pKIRx:79mqyNhQMOtEvwDpjBxe8TpXRx
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
Processes:
resource yara_rule behavioral1/memory/3016-0-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 \Users\Admin\AppData\Local\Temp\asih.exe CryptoLocker_rule2 behavioral1/memory/3016-15-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2792-17-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 4 IoCs
Processes:
resource yara_rule behavioral1/memory/3016-0-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 \Users\Admin\AppData\Local\Temp\asih.exe CryptoLocker_set1 behavioral1/memory/3016-15-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 behavioral1/memory/2792-17-0x0000000000500000-0x000000000050F000-memory.dmp CryptoLocker_set1 -
Executes dropped EXE 1 IoCs
Processes:
asih.exepid process 2792 asih.exe -
Loads dropped DLL 1 IoCs
Processes:
2024-01-25_7b7f7551062c8ddacd2338b8325d28be_cryptolocker.exepid process 3016 2024-01-25_7b7f7551062c8ddacd2338b8325d28be_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-01-25_7b7f7551062c8ddacd2338b8325d28be_cryptolocker.exedescription pid process target process PID 3016 wrote to memory of 2792 3016 2024-01-25_7b7f7551062c8ddacd2338b8325d28be_cryptolocker.exe asih.exe PID 3016 wrote to memory of 2792 3016 2024-01-25_7b7f7551062c8ddacd2338b8325d28be_cryptolocker.exe asih.exe PID 3016 wrote to memory of 2792 3016 2024-01-25_7b7f7551062c8ddacd2338b8325d28be_cryptolocker.exe asih.exe PID 3016 wrote to memory of 2792 3016 2024-01-25_7b7f7551062c8ddacd2338b8325d28be_cryptolocker.exe asih.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_7b7f7551062c8ddacd2338b8325d28be_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_7b7f7551062c8ddacd2338b8325d28be_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:2792
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\asih.exeFilesize
50KB
MD50d220fde98720e23eb184da43ddfdf00
SHA132574fd9fc0c7602d3964c289ffb161fb3b24ec0
SHA25699882eeac55e9b9478929bb2437ea668bd092bee68c46f811f4d8f9adb03a4d9
SHA512968e88f4907fa9976301c0e8226304f519a1222169974ca07a671c5bb498a5957d7a7ca049bb06c1523e21ba36d0fdb59c4715f9de6b623f2b94f0cdbd814805
-
memory/2792-17-0x0000000000500000-0x000000000050F000-memory.dmpFilesize
60KB
-
memory/2792-18-0x00000000004E0000-0x00000000004E6000-memory.dmpFilesize
24KB
-
memory/2792-25-0x0000000000250000-0x0000000000256000-memory.dmpFilesize
24KB
-
memory/3016-0-0x0000000000500000-0x000000000050F000-memory.dmpFilesize
60KB
-
memory/3016-1-0x00000000001D0000-0x00000000001D6000-memory.dmpFilesize
24KB
-
memory/3016-2-0x00000000002A0000-0x00000000002A6000-memory.dmpFilesize
24KB
-
memory/3016-9-0x00000000001D0000-0x00000000001D6000-memory.dmpFilesize
24KB
-
memory/3016-15-0x0000000000500000-0x000000000050F000-memory.dmpFilesize
60KB