11e26bfbf08684897cebed3e3c094c9abcccdcaa9361cccdaca4783ddc0c0077

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_df53780ac07f6b46677077c06253f744_cryptolocker.exe
Size

37KB
MD5

df53780ac07f6b46677077c06253f744
SHA1

b408757a174615381ada8c4046fcc99ef175a09b
SHA256

11e26bfbf08684897cebed3e3c094c9abcccdcaa9361cccdaca4783ddc0c0077
SHA512

8f7e6b142fe790602a1cef8125afd8b291f070999a19c8096b8e88820dd3f811748a43c7032df62cfcac0048e17f7b16a26436c7c212c3c614cfdebab9153c17
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaac4HKcf7:X6QFElP6n+gJQMOtEvwDpjBsYK67

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

1232 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-01-25_df53780ac07f6b46677077c06253f744_cryptolocker.exe

pid process

3052 2024-01-25_df53780ac07f6b46677077c06253f744_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1232	asih.exe

pid	process
3052	2024-01-25_df53780ac07f6b46677077c06253f744_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-01-25_df53780ac07f6b46677077c06253f744_cryptolocker.exe

description	pid	process	target process
PID 3052 wrote to memory of 1232	3052	2024-01-25_df53780ac07f6b46677077c06253f744_cryptolocker.exe	asih.exe
PID 3052 wrote to memory of 1232	3052	2024-01-25_df53780ac07f6b46677077c06253f744_cryptolocker.exe	asih.exe
PID 3052 wrote to memory of 1232	3052	2024-01-25_df53780ac07f6b46677077c06253f744_cryptolocker.exe	asih.exe
PID 3052 wrote to memory of 1232	3052	2024-01-25_df53780ac07f6b46677077c06253f744_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-01-25_df53780ac07f6b46677077c06253f744_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_df53780ac07f6b46677077c06253f744_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:1232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe
Filesize
37KB

MD5
c12863e8c5ef52d956c8ede6f1321b7b

SHA1
1516e348e16bf1891df54f84915506fec3624988

SHA256
a190025b8cd0ecfb532bbfaa0f4111db716e30997ef3c2de53e7d37e8b99bf9a

SHA512
d4351124609f4db5cd57dd039f2eeedc6297becc8406000ca3a0c0d6b45b46ad26619cf8689c17f4c0b6c1179c196fbe58db60527b0249ac55b45cb565dea238

Download Submit
memory/1232-22-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/1232-15-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/3052-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3052-1-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/3052-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download