7c1b54c779bae89181ffca2fa3cef74e9cf19bf4b24b659376ee363a315b7990

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_2441cba914fdde916ae4be2cf9d95207_cryptolocker.exe
Size

36KB
MD5

2441cba914fdde916ae4be2cf9d95207
SHA1

5e69b7da24ce7ed9e2998954ac036556863590ab
SHA256

7c1b54c779bae89181ffca2fa3cef74e9cf19bf4b24b659376ee363a315b7990
SHA512

95498ac7fc254c9f04eab7e44a65e20ee0d053c459d4eb9af1e3d2377072b19878780ec3bb9403ddd8544e6f86a6f776e81f28e9852469867df24d080afd2feb
SSDEEP

768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkCuU:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkq

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/1996-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000b00000001225f-11.dat	CryptoLocker_rule2
behavioral1/memory/1996-13-0x0000000002700000-0x000000000270B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1996-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2124-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/1996-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000b00000001225f-11.dat	CryptoLocker_set1
behavioral1/memory/1996-13-0x0000000002700000-0x000000000270B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1996-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2124-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2124	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1996	2024-01-25_2441cba914fdde916ae4be2cf9d95207_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2124	1996	2024-01-25_2441cba914fdde916ae4be2cf9d95207_cryptolocker.exe	28
PID 1996 wrote to memory of 2124	1996	2024-01-25_2441cba914fdde916ae4be2cf9d95207_cryptolocker.exe	28
PID 1996 wrote to memory of 2124	1996	2024-01-25_2441cba914fdde916ae4be2cf9d95207_cryptolocker.exe	28
PID 1996 wrote to memory of 2124	1996	2024-01-25_2441cba914fdde916ae4be2cf9d95207_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-25_2441cba914fdde916ae4be2cf9d95207_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_2441cba914fdde916ae4be2cf9d95207_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
36KB

MD5
5be6551569e68f0649cf0dc356886a33

SHA1
49c98ddf631730a92ff8c78b9e8ffa86d3fce8e4

SHA256
1044672623ac90004bf1fbf3bd534cc76931f67e081928ab89aa67e4ad965d12

SHA512
9c4d6b5e84f8a24938bb2b875dd29997a9770ac89c09a63cf3eabbe44bad623e04d126b9dd0411cef8034c93698f0d9a15564695cf740c0a337b72c089aa5ab1

Download Submit
memory/1996-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1996-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1996-2-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/1996-3-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1996-13-0x0000000002700000-0x000000000270B000-memory.dmp

Filesize
44KB

Download
memory/1996-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2124-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2124-19-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2124-26-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download