1ef6b7556a54fb026120b6314e09d10a25ea84a7ce17f198c06287ed966f5f4d

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-01-2024 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-26_a734acd9f9ca7ca5383b3081cd0f29e5_cryptolocker.exe
Size

82KB
MD5

a734acd9f9ca7ca5383b3081cd0f29e5
SHA1

d0d858becf8e027b7c424ab51a6b0a1036583477
SHA256

1ef6b7556a54fb026120b6314e09d10a25ea84a7ce17f198c06287ed966f5f4d
SHA512

dc849a12f2cb38f9fa3d0f41dd303bc086f971c5ac548ddfb4417e701bc74e316e1aa917e1ba29745904a4a20cce8f97a313ce87a52e7644c3f27a6001cc31c3
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLa5VccPtNw5CS95yFPFH9:V6QFElP6n+gMQMOtEvwDpjyaLccVNlh

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012327-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012327-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2328	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1992	2024-01-26_a734acd9f9ca7ca5383b3081cd0f29e5_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2328	1992	2024-01-26_a734acd9f9ca7ca5383b3081cd0f29e5_cryptolocker.exe	28
PID 1992 wrote to memory of 2328	1992	2024-01-26_a734acd9f9ca7ca5383b3081cd0f29e5_cryptolocker.exe	28
PID 1992 wrote to memory of 2328	1992	2024-01-26_a734acd9f9ca7ca5383b3081cd0f29e5_cryptolocker.exe	28
PID 1992 wrote to memory of 2328	1992	2024-01-26_a734acd9f9ca7ca5383b3081cd0f29e5_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-26_a734acd9f9ca7ca5383b3081cd0f29e5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-26_a734acd9f9ca7ca5383b3081cd0f29e5_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
82KB

MD5
d1b61a5270930680550c7a09f830bc9c

SHA1
8cb6252857155dafe525f0cc395f14bfdef439a8

SHA256
5fc3c8b5a5e67e9661cfd020a09d6603d07ff02abd7c2e85bfa265019de82a59

SHA512
647c823f209cd969d7098fcdeafbcdfcefc73cca6edc2c7368f061b69fd1295c33f7fba1255857ee8c5a649874cdbd3347da02352f7f0cbfeb0836c06d26862a

Download Submit
memory/1992-0-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/1992-1-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/1992-2-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/2328-15-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download