10096efdf37a9bd494178d27b5353d10404f614ecb554bd5e4ab3e7cf626462b

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 16:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-26_c9518123ac862863cbe7406b2b5a8e9e_cryptolocker.exe
Size

36KB
MD5

c9518123ac862863cbe7406b2b5a8e9e
SHA1

3d95346ca9cc36fd30922614f24f5e31bf4d1429
SHA256

10096efdf37a9bd494178d27b5353d10404f614ecb554bd5e4ab3e7cf626462b
SHA512

7c7d2d47d3b926c6121b0854b16b08e60795dd083ad75d4c7634acf94dfeb73c4aff7e56c68a21afdbd7fe2659c14e16748095b8b7ea49d6375755a293a07b7c
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaac4Hr:X6QFElP6n+gJQMOtEvwDpjBsYr

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000013a71-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000013a71-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
3052	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2392	2024-01-26_c9518123ac862863cbe7406b2b5a8e9e_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 3052	2392	2024-01-26_c9518123ac862863cbe7406b2b5a8e9e_cryptolocker.exe	28
PID 2392 wrote to memory of 3052	2392	2024-01-26_c9518123ac862863cbe7406b2b5a8e9e_cryptolocker.exe	28
PID 2392 wrote to memory of 3052	2392	2024-01-26_c9518123ac862863cbe7406b2b5a8e9e_cryptolocker.exe	28
PID 2392 wrote to memory of 3052	2392	2024-01-26_c9518123ac862863cbe7406b2b5a8e9e_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-26_c9518123ac862863cbe7406b2b5a8e9e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-26_c9518123ac862863cbe7406b2b5a8e9e_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
36KB

MD5
ae97e4f1a1657e3bb7a0d1772b0ba58f

SHA1
fffc64641dedf381a6edbe05a29717116f5e6c77

SHA256
75532fcbce688a29f10d45d8e774794e7c1f52db08dabee6f8c9d607a5c65c7a

SHA512
4330c424a132b4a078c14eaaf5022613865b026f715c910ec66bd6ae2f313e902d2f3dacfe1437a05dd0d5813669bc2988e6a1725d47973970e3b377b1ead6c3

Download Submit
memory/2392-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2392-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2392-2-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/3052-15-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download