3c7e20476d3297f74f1ea9cfd055454a9c627f4ef26236d955127748323071d5

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_52f0c5472cd307ab7e04b44ca314da89_cryptolocker.exe
Size

67KB
MD5

52f0c5472cd307ab7e04b44ca314da89
SHA1

e9e8aafb156d20ec73554ee0aae75a0e49717a0c
SHA256

3c7e20476d3297f74f1ea9cfd055454a9c627f4ef26236d955127748323071d5
SHA512

1730de471bbb2ff58ac251d77657ce984625f7d89692dff319bdeebba51cc8b85a5b8f279f4c82c7e327bd60c0b91ae6dbfd9be2d7579dc536dbba740fe02671
SSDEEP

1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKU9:DW60sllyWOtEvwDpjwF85j

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2152-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2152-13-0x00000000026C0000-0x00000000026CB000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2152-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2368-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2152-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2152-13-0x00000000026C0000-0x00000000026CB000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2152-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2368-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2368 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-01-25_52f0c5472cd307ab7e04b44ca314da89_cryptolocker.exe

pid process

2152 2024-01-25_52f0c5472cd307ab7e04b44ca314da89_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2368	asih.exe

pid	process
2152	2024-01-25_52f0c5472cd307ab7e04b44ca314da89_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-01-25_52f0c5472cd307ab7e04b44ca314da89_cryptolocker.exe

description	pid	process	target process
PID 2152 wrote to memory of 2368	2152	2024-01-25_52f0c5472cd307ab7e04b44ca314da89_cryptolocker.exe	asih.exe
PID 2152 wrote to memory of 2368	2152	2024-01-25_52f0c5472cd307ab7e04b44ca314da89_cryptolocker.exe	asih.exe
PID 2152 wrote to memory of 2368	2152	2024-01-25_52f0c5472cd307ab7e04b44ca314da89_cryptolocker.exe	asih.exe
PID 2152 wrote to memory of 2368	2152	2024-01-25_52f0c5472cd307ab7e04b44ca314da89_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-01-25_52f0c5472cd307ab7e04b44ca314da89_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_52f0c5472cd307ab7e04b44ca314da89_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2152

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe
Filesize
68KB

MD5
932e58a6393803d93ac9918adc0cc976

SHA1
01cd342ce1c803e92a96d64e0af6b94c59617f5b

SHA256
37015f10c70a6a0a29d005f843dd2a50be2e5202ab26213895ce97dcdec89097

SHA512
3e746088267722f16b16ec7ddb4e45ce61e93036efacafb510cc64e0f96b8789d33837060da7c095fc7acb7c902fe5a90d199b9483fdb29bc00f7282a71256ba

Download Submit
memory/2152-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2152-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2152-3-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2152-2-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2152-13-0x00000000026C0000-0x00000000026CB000-memory.dmp

Filesize
44KB

Download
memory/2152-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2368-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2368-19-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2368-26-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download