f4c5c530a31fcd80540778349c53b1487a03ef4a828d5f6a7b9e19b32122f7bb

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_19ef5f2c0b668b9898458c3c18eb1571_cryptolocker.exe
Size

55KB
MD5

19ef5f2c0b668b9898458c3c18eb1571
SHA1

1ad4fb5fa4a07375b566155ec38cf2c8265ec939
SHA256

f4c5c530a31fcd80540778349c53b1487a03ef4a828d5f6a7b9e19b32122f7bb
SHA512

9bfd38c98ed23885b0ec788f7258ad7ade967c6feccf48c7884749757198a5a77d37a52f5223a7919a7514dad38689fcf312751e1e3bef4c69a9c29448b5fb39
SSDEEP

768:79inqyNR/QtOOtEvwDpjBK/iVTab3GRuv3VylsPxAy:79mqyNhQMOtEvwDpjBPY7xv3gy5Z

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1944-1-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1944-14-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral1/memory/2492-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1944-1-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1944-14-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral1/memory/2492-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2492 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-01-25_19ef5f2c0b668b9898458c3c18eb1571_cryptolocker.exe

pid process

1944 2024-01-25_19ef5f2c0b668b9898458c3c18eb1571_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2492	asih.exe

pid	process
1944	2024-01-25_19ef5f2c0b668b9898458c3c18eb1571_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-01-25_19ef5f2c0b668b9898458c3c18eb1571_cryptolocker.exe

description	pid	process	target process
PID 1944 wrote to memory of 2492	1944	2024-01-25_19ef5f2c0b668b9898458c3c18eb1571_cryptolocker.exe	asih.exe
PID 1944 wrote to memory of 2492	1944	2024-01-25_19ef5f2c0b668b9898458c3c18eb1571_cryptolocker.exe	asih.exe
PID 1944 wrote to memory of 2492	1944	2024-01-25_19ef5f2c0b668b9898458c3c18eb1571_cryptolocker.exe	asih.exe
PID 1944 wrote to memory of 2492	1944	2024-01-25_19ef5f2c0b668b9898458c3c18eb1571_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-01-25_19ef5f2c0b668b9898458c3c18eb1571_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_19ef5f2c0b668b9898458c3c18eb1571_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1944

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe
Filesize
55KB

MD5
5354c366a6c4696166abbce80f44f5b4

SHA1
d4f4138c85db4f0d2bfd6c47271e220350730ff0

SHA256
d94e048d1a46878cda5f007a6006ed9c05ca46708db4aa1379a38ec77d5ae205

SHA512
cb8d6d4ce31287c549b442d1cf1aec68c0f93cdc16ff29bf2721ed1606ea169a52b6f8a70fc4523a2b6849996bdd452b32437012b91aa8f9bd774f9de2927f4a

Download Submit
memory/1944-1-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1944-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1944-2-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/1944-3-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1944-14-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2492-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2492-18-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2492-20-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download