0193b46d4695f093488db94d3869aaac82c6e6064a3832ffa3dbe6e03d8e0a11

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_265f8911ed61286982f3c57dcf9cbe9e_cryptolocker.exe
Size

61KB
MD5

265f8911ed61286982f3c57dcf9cbe9e
SHA1

6cf8f16e7b307500ee1191dd747a2523cda911c8
SHA256

0193b46d4695f093488db94d3869aaac82c6e6064a3832ffa3dbe6e03d8e0a11
SHA512

b689fe77e52eded0c4834a4ce50e8d556d0f2d4fcd55c2094a0d377f9fc45b15139f41c6b42ba5f3a71133b8af3a0912eb2a9e301cf5160a4db8bdee90e7143e
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjyaLccVCbmhk3:V6a+pOtEvwDpjvy

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012262-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012262-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2728	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2252	2024-01-25_265f8911ed61286982f3c57dcf9cbe9e_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2728	2252	2024-01-25_265f8911ed61286982f3c57dcf9cbe9e_cryptolocker.exe	28
PID 2252 wrote to memory of 2728	2252	2024-01-25_265f8911ed61286982f3c57dcf9cbe9e_cryptolocker.exe	28
PID 2252 wrote to memory of 2728	2252	2024-01-25_265f8911ed61286982f3c57dcf9cbe9e_cryptolocker.exe	28
PID 2252 wrote to memory of 2728	2252	2024-01-25_265f8911ed61286982f3c57dcf9cbe9e_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-25_265f8911ed61286982f3c57dcf9cbe9e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_265f8911ed61286982f3c57dcf9cbe9e_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
61KB

MD5
d393cc1acf1009a9bd267d4e7d59733d

SHA1
4cc844cad4b28a737fb40fdfe8917516cd1f0dd3

SHA256
d04971094584a47f5fd308a13625e5d4697ef29c65154117ee96648f0c366d08

SHA512
3d4e11d75832e98bc565cb1013ede3b9b3fcea490df6738ac24fc730d7dd65d5f0c4e89d3e5f1f66a006a39f8fb36625d60a88d492b85e4c67b6e8dd27570a3a

Download Submit
memory/2252-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2252-2-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2252-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2728-15-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2728-16-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download