bdbb23f05c9745bf7b25af21f1f776469970c2b3d1396aa857904a38ade17116

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-27_30e3bbbaf034fc61b402ce73e318be5c_cryptolocker.exe
Size

48KB
MD5

30e3bbbaf034fc61b402ce73e318be5c
SHA1

4374378507f96131fcdc637a0f5b29e0038cc897
SHA256

bdbb23f05c9745bf7b25af21f1f776469970c2b3d1396aa857904a38ade17116
SHA512

ffac86cdc75909d38157408663ae3d5e0c2258eb2fdb47af34c731e005fe96ae25e3ef4c3ebcdafaa18fcfe0d421d81c97557344cb36330a2bfeb76f4b8af28a
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vxo:X6QFElP6n+gJBMOtEvwDpjBtExo

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000013a1a-13.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000013a1a-13.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
1100	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2156	2024-01-27_30e3bbbaf034fc61b402ce73e318be5c_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 1100	2156	2024-01-27_30e3bbbaf034fc61b402ce73e318be5c_cryptolocker.exe	16
PID 2156 wrote to memory of 1100	2156	2024-01-27_30e3bbbaf034fc61b402ce73e318be5c_cryptolocker.exe	16
PID 2156 wrote to memory of 1100	2156	2024-01-27_30e3bbbaf034fc61b402ce73e318be5c_cryptolocker.exe	16
PID 2156 wrote to memory of 1100	2156	2024-01-27_30e3bbbaf034fc61b402ce73e318be5c_cryptolocker.exe	16

C:\Users\Admin\AppData\Local\Temp\2024-01-27_30e3bbbaf034fc61b402ce73e318be5c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-27_30e3bbbaf034fc61b402ce73e318be5c_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
48KB

MD5
a6aa8f9630fa703abadbf6636f551c40

SHA1
f63a6508628ddf7853ae43e29212a35363dbc0be

SHA256
e3384c0e21e7e56fec10569748feb20d54bef04be63a0356335a82c9683d6ff9

SHA512
812b101a629bd3cd9e73f6d7b809d89180f4f17d2ba7c5efb462fa60ff5a5d83967ff48c9afa248666bace64ec15867127dc6198a27199e7d956a79fa15eda15

Download Submit
memory/1100-17-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2156-8-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2156-1-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/2156-0-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download