ca256ecb0e7ff2121f9349e15f220b5849e4baafc89b9aef11ca9d80514abcf7

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_9b3f32a285f0924d1dfa7a5fa4a70034_cryptolocker.exe
Size

49KB
MD5

9b3f32a285f0924d1dfa7a5fa4a70034
SHA1

8f07927f84b2d97cee94099f339a42261c63f840
SHA256

ca256ecb0e7ff2121f9349e15f220b5849e4baafc89b9aef11ca9d80514abcf7
SHA512

74d60c199864e06be8cc5e7ea59305dfdc1142d4af92cb09d68514873fe85805ea496d0a72ccca9ffcb7be70278e1595282fb38148216be105af03ab465280d7
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpjeJQ7suIlsw92KFXpQenhux:V6QFElP6n+gMQMOtEvwDpjeJQ7pojkRx

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2816 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-01-25_9b3f32a285f0924d1dfa7a5fa4a70034_cryptolocker.exe

pid process

2248 2024-01-25_9b3f32a285f0924d1dfa7a5fa4a70034_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2816	asih.exe

pid	process
2248	2024-01-25_9b3f32a285f0924d1dfa7a5fa4a70034_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-01-25_9b3f32a285f0924d1dfa7a5fa4a70034_cryptolocker.exe

description	pid	process	target process
PID 2248 wrote to memory of 2816	2248	2024-01-25_9b3f32a285f0924d1dfa7a5fa4a70034_cryptolocker.exe	asih.exe
PID 2248 wrote to memory of 2816	2248	2024-01-25_9b3f32a285f0924d1dfa7a5fa4a70034_cryptolocker.exe	asih.exe
PID 2248 wrote to memory of 2816	2248	2024-01-25_9b3f32a285f0924d1dfa7a5fa4a70034_cryptolocker.exe	asih.exe
PID 2248 wrote to memory of 2816	2248	2024-01-25_9b3f32a285f0924d1dfa7a5fa4a70034_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-01-25_9b3f32a285f0924d1dfa7a5fa4a70034_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_9b3f32a285f0924d1dfa7a5fa4a70034_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe
Filesize
50KB

MD5
199a2cab08ddec8a7f943b5a0d5dfca8

SHA1
9902bd373aaef838d9070452f135aedfae6b394c

SHA256
586d31370cefc2d9778f9c99268dbd29df059b3e1c33b68f36d3dc45821a6c36

SHA512
93b3dfa7478f46c2d00aa5c2fc5ee7b511d37c40b4ae863b547c0954251ab093be7c414a128ab3017ab46a171fc2a75daff11bafadf54f271a30fb75c05694ba

Download Submit
memory/2248-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2248-2-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2248-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2816-22-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2816-15-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download