Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/01/2024, 20:25

General

  • Target

    2024-01-25_54dd908d8c8886494a5b9b91764baccf_cryptolocker.exe

  • Size

    50KB

  • MD5

    54dd908d8c8886494a5b9b91764baccf

  • SHA1

    0191c7fcccaef6c7260b8725d27efa1133886315

  • SHA256

    5459259fce86414bda859055216a1aeb868c19d018edfa9b4927587f147ba9e0

  • SHA512

    3ac11f9c80afa383b4713b43160081ba3051f7334b6d79fe460926d8412186adda4517bcd1a5d71e3386ac859d74fb7c9c9cb05c2a0b140f7c82355466b04c66

  • SSDEEP

    768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vaToguM+:X6QFElP6n+gJBMOtEvwDpjBtEJNM+

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-25_54dd908d8c8886494a5b9b91764baccf_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-25_54dd908d8c8886494a5b9b91764baccf_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2316

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\asih.exe

          Filesize

          50KB

          MD5

          f542c3f8ebe1b1798efea4068ba30d15

          SHA1

          5675766fc84c6771781641edd2f9dd0c89fc5116

          SHA256

          7108a53cb57453b6ecc1350ba45060b82af683b3cde68ab35e31b599511756ca

          SHA512

          e357b1c82fd4ad1cb97fb2d1fdef66a8d5d57be34cd0c197cac1aaa4870477182cc0268bddcf554758e7f6d1384e6c87f0c91c0fc1086000ebf581c6b5c92c30

        • memory/1736-1-0x0000000000300000-0x0000000000306000-memory.dmp

          Filesize

          24KB

        • memory/1736-8-0x0000000000240000-0x0000000000246000-memory.dmp

          Filesize

          24KB

        • memory/1736-0-0x0000000000240000-0x0000000000246000-memory.dmp

          Filesize

          24KB

        • memory/2316-15-0x0000000000370000-0x0000000000376000-memory.dmp

          Filesize

          24KB

        • memory/2316-22-0x0000000000320000-0x0000000000326000-memory.dmp

          Filesize

          24KB