6e863e221a6dfd931ff3fc3cc468b9f184bd7723faa26430eb2ae653c5cc1975

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-01_dc6ae2cd40424df36c1262ab8d1ede12_cryptolocker.exe
Size

45KB
MD5

dc6ae2cd40424df36c1262ab8d1ede12
SHA1

2a68a018b698979a019ead22b771b3bb1b17f197
SHA256

6e863e221a6dfd931ff3fc3cc468b9f184bd7723faa26430eb2ae653c5cc1975
SHA512

3fdaa6628fc20e69023f17c56d4b5b30829897e8dd800ac5ec20edd1a6dbf17c9ee3e0ececff6167901dae6f7a67e2094c92eca64749bed78281d646ce856a41
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaaEqbIu556yPRz:X6QFElP6n+gJQMOtEvwDpjB0GIWvPRz

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001232d-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001232d-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2376	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2236	2024-02-01_dc6ae2cd40424df36c1262ab8d1ede12_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2376	2236	2024-02-01_dc6ae2cd40424df36c1262ab8d1ede12_cryptolocker.exe	28
PID 2236 wrote to memory of 2376	2236	2024-02-01_dc6ae2cd40424df36c1262ab8d1ede12_cryptolocker.exe	28
PID 2236 wrote to memory of 2376	2236	2024-02-01_dc6ae2cd40424df36c1262ab8d1ede12_cryptolocker.exe	28
PID 2236 wrote to memory of 2376	2236	2024-02-01_dc6ae2cd40424df36c1262ab8d1ede12_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-01_dc6ae2cd40424df36c1262ab8d1ede12_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-01_dc6ae2cd40424df36c1262ab8d1ede12_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
45KB

MD5
14c41b0247001e8fd6bfa290dd2d42e7

SHA1
b7f6c10f6e2381f8e3e4911ab938a8dd8e8ecf9d

SHA256
ae50e0cc6e8115d8fc6ad65b4dedc04351d3404dad55db0f470b902633588b5b

SHA512
3780e639fd34ebfa6791fa649f80121b6f33aaba3928f79fb19d857a2836bd21c9186fba8e6c92c05cbc18d1c9e0b53a70ebbb39d47d794af8b876023e9e5dcf

Download Submit
memory/2236-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2236-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2236-1-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download