75a30629e993f05e12756f855d4125d28e0905e4a1b7315b164e2d1c83d06148

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 16:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-28_7d17258bc86d6d1dcb39ffedd05a477d_cryptolocker.exe
Size

42KB
MD5

7d17258bc86d6d1dcb39ffedd05a477d
SHA1

a1410658d65c19cdc9008050fa735385c15ab0c2
SHA256

75a30629e993f05e12756f855d4125d28e0905e4a1b7315b164e2d1c83d06148
SHA512

1272cefbcdb158796cd7107480bf9f4acf6d39a8d834b564edfad574e62500eaacb20c087cdce3af7d0ca182d285a2699e5ae803d7d28ded62e510c2debbe247
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLaHaMMm2XVpA:V6QFElP6n+gMQMOtEvwDpjyaHaXm

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000122f3-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000122f3-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2660	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2352	2024-01-28_7d17258bc86d6d1dcb39ffedd05a477d_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2660	2352	2024-01-28_7d17258bc86d6d1dcb39ffedd05a477d_cryptolocker.exe	28
PID 2352 wrote to memory of 2660	2352	2024-01-28_7d17258bc86d6d1dcb39ffedd05a477d_cryptolocker.exe	28
PID 2352 wrote to memory of 2660	2352	2024-01-28_7d17258bc86d6d1dcb39ffedd05a477d_cryptolocker.exe	28
PID 2352 wrote to memory of 2660	2352	2024-01-28_7d17258bc86d6d1dcb39ffedd05a477d_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-28_7d17258bc86d6d1dcb39ffedd05a477d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-28_7d17258bc86d6d1dcb39ffedd05a477d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
42KB

MD5
182e26f06cdaa120817e9a9ed2d8d7c8

SHA1
9cd612997b16779982579f1d042feb7016ff17b1

SHA256
7e74471a3d3805b5417aed4959f32ebe8261a2c5be6d8a0c7dfe53416cdf0e08

SHA512
29cbd4e06954daf99e76c7ed2b2004c16a3ea32b1b88eb7b5912af7304dd884b2ece9ab75482f36251eab8c239fd8fdec85f144b9a187ebe0a0ed7f5ad8bb67e

Download Submit
memory/2352-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2352-2-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2352-1-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2660-15-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2660-16-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download