Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 17:38
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-25_d8bfcf526204c125175c6464a95a85fc_cryptolocker.exe
Resource
win7-20231215-en
General
-
Target
2024-01-25_d8bfcf526204c125175c6464a95a85fc_cryptolocker.exe
-
Size
82KB
-
MD5
d8bfcf526204c125175c6464a95a85fc
-
SHA1
bbacfed023311f2946b02aa1bd18be4a0e4cbbd0
-
SHA256
080dcc93111a9aae10255f9d459556f588c631758196e9d8fc3580d7da9d02a8
-
SHA512
b977bf9f90febca34a5662e84c0ee8df9168196ce2051ab7df26243dccc303b1bc137e6937631eeeeef9548dcb5e04dfaf0dfe865e91df1a37cc6178d07af4e4
-
SSDEEP
768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLa5VccPtNw5CS95yFPFHn:V6QFElP6n+gMQMOtEvwDpjyaLccVNlr
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\asih.exe CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\asih.exe CryptoLocker_set1 -
Executes dropped EXE 1 IoCs
Processes:
asih.exepid process 2248 asih.exe -
Loads dropped DLL 1 IoCs
Processes:
2024-01-25_d8bfcf526204c125175c6464a95a85fc_cryptolocker.exepid process 2420 2024-01-25_d8bfcf526204c125175c6464a95a85fc_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-01-25_d8bfcf526204c125175c6464a95a85fc_cryptolocker.exedescription pid process target process PID 2420 wrote to memory of 2248 2420 2024-01-25_d8bfcf526204c125175c6464a95a85fc_cryptolocker.exe asih.exe PID 2420 wrote to memory of 2248 2420 2024-01-25_d8bfcf526204c125175c6464a95a85fc_cryptolocker.exe asih.exe PID 2420 wrote to memory of 2248 2420 2024-01-25_d8bfcf526204c125175c6464a95a85fc_cryptolocker.exe asih.exe PID 2420 wrote to memory of 2248 2420 2024-01-25_d8bfcf526204c125175c6464a95a85fc_cryptolocker.exe asih.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_d8bfcf526204c125175c6464a95a85fc_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_d8bfcf526204c125175c6464a95a85fc_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:2248
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5a8c23f4349e6eada928b74d22e3c1730
SHA1948e5eec3a35e27bcf98ebf5b1bf40bebfdb98ef
SHA256d488443db82fe8f77bc17129e34d12e861d788d75de02f817ad9cf656e3cbf11
SHA512469eee290591456a37f6d7ab768961326da960f1834b7dfd2e8d8463756248dd331fabdf543af4553b391cc36c4a65e428392c19cd16ebd5d407ea645bc3c571